Is there a public PoC exploit available for CVE-2026-62996?

Yes, a public proof-of-concept exploit is available for CVE-2026-62996. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-62996?

Yes, a patch is available for CVE-2026-62996. Update the affected software to the latest version immediately.

Smarty CVE-2026-62996

Q: What is the CVSS score of CVE-2026-62996?

CVE-2026-62996 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54499 MEDIUM

Path Traversal (CWE-22)

2026-08-07 GitHub_M

GHSA-rjhh-76wf-8xmw

PHP Path Traversal Smarty Smarty Php

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.9 MEDIUM

Template authoring privileges required (PR:H); network-reachable but scoped to file read only (C:H/I:N/A:N); no scope change beyond PHP process.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 07, 2026 - 16:02 EUVD

Source Code Evidence Fetched

Aug 07, 2026 - 15:51 vuln.today

Analysis Generated

Aug 07, 2026 - 15:51 vuln.today

CVE Published

Aug 07, 2026 - 15:04 cve.org

MEDIUM 6.9

DescriptionCVE.org

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents outside the intended template/config scope. This issue is fixed in version 5.8.4.

AnalysisAI

Smarty PHP template engine versions 5.0.0 through 5.8.3 expose a security policy bypass allowing file disclosure via the built-in stream: resource type. When Smarty Security is enabled and Security::$streams is set to null or a restricted allowlist, an attacker able to author or influence a template resource reference can use stream:php://filter/... to read arbitrary local files accessible to the PHP process - bypassing the very control intended to block such access. A public proof-of-concept was disclosed in GHSA-rjhh-76wf-8xmw; no active exploitation is confirmed in CISA KEV. The issue is fixed in v5.8.4.

Technical ContextAI

Smarty's resource-loading pipeline in BasePlugin::load() maps the built-in sysplugin name stream directly to StreamPlugin before the code path that validates PHP stream wrappers via stream_get_wrappers() and Security::isTrustedStream(). As a result, StreamPlugin::getContent() receives the nested URI (e.g., php://filter/read=convert.base64-encode/resource=/etc/passwd) and calls fopen() on it without the security policy having vetted the underlying php wrapper. The root cause is CWE-22 (Path Traversal) compounded by CWE-441 (Unintended Proxy/Intermediary), where the stream: resource acts as an unvalidated intermediary routing around the Security::$streams enforcement boundary. Affected package is smarty/smarty on Packagist, CPE cpe:2.3:a:smarty-php:smarty:*:*:*:*:*:*:*:*, versions 5.0.0 through 5.8.3.

RemediationAI

Upgrade smarty/smarty to version 5.8.4 or later via Composer (composer require smarty/smarty:^5.8.4 or composer update smarty/smarty). The fix was implemented in commit 3c9f77a2e06ce319ae0092496af32cc8f3adc52e (PR #1195) and released at https://github.com/smarty-php/smarty/releases/tag/v5.8.4. The patch adds an explicit stream-wrapper validation step inside StreamPlugin::getContent() that parses the nested URI scheme and calls isTrustedStream() before fopen(). If an immediate upgrade is blocked, the most effective compensating control is to eliminate all untrusted influence over template resource references - specifically, never pass user-controlled strings as the file parameter of {include} directives. Note that relying solely on Security::$streams = null is not a compensating control for this CVE, as that is precisely the policy being bypassed. Auditing template storage and render pipelines for user-controlled include paths is advisable regardless of patching status.