Smarty
Monthly
Server-side request forgery in Smarty's {fetch} template function (versions prior to 4.5.7 on the 4.x line and 5.8.2 on the 5.x line) allows network-accessible attackers to bypass the trusted_uri allowlist and reach arbitrary internal endpoints by exploiting PHP's default redirect-following behavior. The security policy's isTrustedUri() check validates only the initial URL; when file_get_contents() silently follows an HTTP redirect placed on a trusted host, the request lands on an attacker-chosen internal target, enabling SSRF to services such as cloud metadata endpoints or internal APIs. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Smarty PHP template engine versions 5.0.0 through 5.8.3 expose a security policy bypass allowing file disclosure via the built-in `stream:` resource type. When Smarty Security is enabled and `Security::$streams` is set to `null` or a restricted allowlist, an attacker able to author or influence a template resource reference can use `stream:php://filter/...` to read arbitrary local files accessible to the PHP process - bypassing the very control intended to block such access. A public proof-of-concept was disclosed in GHSA-rjhh-76wf-8xmw; no active exploitation is confirmed in CISA KEV. The issue is fixed in v5.8.4.
Symlink-based path traversal in Smarty's Security::_checkDir() allows an attacker who can place a symbolic link inside a trusted directory (such as a template or upload path) to read arbitrary files accessible to the PHP process, bypassing the configured secure_dir sandbox entirely. Affected are Smarty 5.x versions prior to 5.8.2 and all 4.x releases prior to 4.5.7, when Smarty's Security policy is enabled. The root cause is that _checkDir() resolves paths via string normalization only, while the underlying file_get_contents() call faithfully follows symlinks to their targets outside the sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Smarty is a template engine for PHP. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in an include statement. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty before 3.1.8 allows remote attackers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
Server-side request forgery in Smarty's {fetch} template function (versions prior to 4.5.7 on the 4.x line and 5.8.2 on the 5.x line) allows network-accessible attackers to bypass the trusted_uri allowlist and reach arbitrary internal endpoints by exploiting PHP's default redirect-following behavior. The security policy's isTrustedUri() check validates only the initial URL; when file_get_contents() silently follows an HTTP redirect placed on a trusted host, the request lands on an attacker-chosen internal target, enabling SSRF to services such as cloud metadata endpoints or internal APIs. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Smarty PHP template engine versions 5.0.0 through 5.8.3 expose a security policy bypass allowing file disclosure via the built-in `stream:` resource type. When Smarty Security is enabled and `Security::$streams` is set to `null` or a restricted allowlist, an attacker able to author or influence a template resource reference can use `stream:php://filter/...` to read arbitrary local files accessible to the PHP process - bypassing the very control intended to block such access. A public proof-of-concept was disclosed in GHSA-rjhh-76wf-8xmw; no active exploitation is confirmed in CISA KEV. The issue is fixed in v5.8.4.
Symlink-based path traversal in Smarty's Security::_checkDir() allows an attacker who can place a symbolic link inside a trusted directory (such as a template or upload path) to read arbitrary files accessible to the PHP process, bypassing the configured secure_dir sandbox entirely. Affected are Smarty 5.x versions prior to 5.8.2 and all 4.x releases prior to 4.5.7, when Smarty's Security policy is enabled. The root cause is that _checkDir() resolves paths via string normalization only, while the underlying file_get_contents() call faithfully follows symlinks to their targets outside the sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Smarty is a template engine for PHP. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in an include statement. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty before 3.1.8 allows remote attackers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.