Every CVE Search/ Get API key

CVE-2023-28447

Cross site scripting vulnerability in Javascript escaping in smarty/smarty

7.1 HighPublic exploitFix available

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

1.02%Up 1.0 points since Mar 29, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.1

Cross site scripting vulnerability in Javascript escaping in smarty/smarty

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

Record
CVE-2023-28447
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2023-0924 7.1

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

Record
EUVD-2023-0924
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-7j98-h7fp-4vwj 7.1

smarty Cross-site Scripting vulnerability in Javascript escaping

Impact

An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user.

Patches

Please upgrade to the most recent version of Smarty v3 or v4.

For more information

If you have any questions or comments about this advisory please open an issue in the Smarty repo

Record
GHSA-7j98-h7fp-4vwj
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
NVD 7.1

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

Record
CVE-2023-28447
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 7.1

Cross site scripting vulnerability in Javascript escaping in smarty/smarty

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

Record
CVE-2023-28447
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2023-28447 6.1

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

Record
DEBIAN-CVE-2023-28447
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-7j98-h7fp-4vwj 7.1

smarty Cross-site Scripting vulnerability in Javascript escaping

Impact

An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user.

Patches

Please upgrade to the most recent version of Smarty v3 or v4.

For more information

If you have any questions or comments about this advisory please open an issue in the Smarty repo

Record
GHSA-7j98-h7fp-4vwj
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2023-28447 7.1

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

Record
UBUNTU-CVE-2023-28447
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2023-0155 No score

Updated php-smarty packages fix security vulnerability

Cross site scripting vulnerability in Javascript escaping. (CVE-2023-28447)

Additional bug fixes included. See referenced release notes for details.

Record
MGASA-2023-0155
Updated
2026-11-02
OSVUSN-6550-1 No score

postfixadmin vulnerabilities

It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. (CVE-2022-29221)

It was discovered that Moment.js, that is integrated in the PostfixAdmin code, was using an inefficient parsing algorithm when processing date strings in the RFC 2822 standard. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-31129)

It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly escaping JavaScript code. An attacker could possibly use this issue to conduct cross-site scripting attacks (XSS). (CVE-2023-28447)

Record
USN-6550-1
Updated
2026-11-02
OSVUSN-7158-1 No score

smarty3 vulnerabilities

It was discovered that Smarty incorrectly handled query parameters in requests. An attacker could possibly use this issue to inject arbitrary Javascript code, resulting in denial of service or potential execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2018-25047, CVE-2023-28447)

It was discovered that Smarty did not properly sanitize user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. (CVE-2024-35226)

Record
USN-7158-1
Updated
2026-11-02
OSVUSN-8242-1 No score

civicrm vulnerability

Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not properly escape JavaScript code. An attacker could possibly use this issue to conduct a cross-site scripting attack.

Record
USN-8242-1
Updated
2026-11-02
OSVUSN-8242-2 No score

postfixadmin vulnerability

USN-8242-1 fixed a vulnerability in CiviCRM. This update provides the corresponding fix for PostfixAdmin.

Original advisory details:

Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not properly escape JavaScript code. An attacker could possibly use this issue to conduct a cross-site scripting attack.

Record
USN-8242-2
Updated
2026-11-02
OSVUSN-8272-1 No score

smarty3 vulnerability

Takuya Aramaki discovered that Smarty did not properly escape JavaScript code. An attacker could possibly use this issue to conduct a cross-site scripting attack.

Record
USN-8272-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
smarty/smarty
Packagist
 4.0.0 up to 4.3.1
4.3.1
smarty/smarty
Packagist
 before 3.1.48
3.1.48
smarty3
Debian:12
 before 3.1.47-2+deb12u1, plus listed versions
3.1.47-2
3.1.47-2+deb12u1
smarty3
Debian:13
 before 3.1.48-1
3.1.48-1
smarty3
Debian:14
 before 3.1.48-1
3.1.48-1
smarty4
Debian:12
 before 4.3.0-1+deb12u1, plus listed versions
4.3.0-1
4.3.0-1+deb12u1
smarty4
Debian:13
 before 4.3.1-1
4.3.1-1
smarty4
Debian:14
 before 4.3.1-1
4.3.1-1
smarty3
Debian:11
From an advisory covering 3 CVEs
 before 3.1.39-2+deb11u2, plus listed versions
3.1.39-13.1.39-23.1.39-2+deb11u1
3.1.39-2+deb11u2
smarty3
Debian:12
From an advisory covering 2 CVEs
 before 3.1.47-2+deb12u1, plus listed versions
3.1.47-2
3.1.47-2+deb12u1
Show 23 moreShow less
Affected packages
PackageAffectedFixed
smarty/smarty
Packagist
 4.0.0 up to 4.3.1, plus listed versions
v4.0.0v4.0.1v4.0.2v4.0.3v4.0.4
Show 5 moreShow less
v4.1.0v4.1.1v4.2.0v4.2.1v4.3.0
4.3.1
smarty/smarty
Packagist
 before 3.1.48, plus listed versions
v2.6.24v2.6.25v2.6.26v2.6.27v2.6.28
Show 41 moreShow less
v2.6.29v2.6.30v2.6.31v2.6.33v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17v3.1.18v3.1.19v3.1.20v3.1.21v3.1.23v3.1.24v3.1.25v3.1.26v3.1.27v3.1.28v3.1.29v3.1.30v3.1.31v3.1.32v3.1.33v3.1.34v3.1.35v3.1.36v3.1.37v3.1.37.1v3.1.38v3.1.39v3.1.40v3.1.41v3.1.42v3.1.43v3.1.44v3.1.45v3.1.46v3.1.47
3.1.48
php-smarty
Mageia:8
 before 4.3.1-1.mga8
4.3.1-1.mga8
civicrm
Ubuntu:Pro:16.04:LTS
 before 4.7.1+dfsg-2ubuntu1+esm1, plus listed versions
4.7.1+dfsg-14.7.1+dfsg-24.7.1+dfsg-2ubuntu1
4.7.1+dfsg-2ubuntu1+esm1
smarty3
Ubuntu:Pro:16.04:LTS
 before 3.1.21-1ubuntu1+esm2, plus listed versions
3.1.21-13.1.21-1ubuntu13.1.21-1ubuntu1+esm1
3.1.21-1ubuntu1+esm2
civicrm
Ubuntu:Pro:18.04:LTS
 before 4.7.30+dfsg-1ubuntu1+esm1, plus listed versions
4.7.23+dfsg-1ubuntu14.7.24+dfsg-1ubuntu14.7.30+dfsg-1ubuntu1
4.7.30+dfsg-1ubuntu1+esm1
postfixadmin
Ubuntu:Pro:18.04:LTS
 before 3.0.2-2ubuntu0.1~esm1, plus listed versions
3.0.2-2
3.0.2-2ubuntu0.1~esm1
smarty3
Ubuntu:Pro:18.04:LTS
 before 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1, plus listed versions
3.1.31+20161214.1.c7d42e4+selfpack1-23.1.31+20161214.1.c7d42e4+selfpack1-33.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1
3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1
smarty3
Ubuntu:20.04:LTS
 before 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1, plus listed versions
3.1.33+20180830.1.3a78a21f+selfpack1-13.1.34+20190228.1.c9f0de05+selfpack1-1
3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1
civicrm
Ubuntu:Pro:20.04:LTS
 before 5.21.2+dfsg-1ubuntu0.1~esm1, plus listed versions
5.11.0+dfsg-15.18.1+dfsg-15.20.3+dfsg-15.21.0+dfsg-15.21.1+dfsg-15.21.2+dfsg-1
5.21.2+dfsg-1ubuntu0.1~esm1
postfixadmin
Ubuntu:Pro:20.04:LTS
 before 3.2.1-3ubuntu0.1~esm1, plus listed versions
3.2.1-23.2.1-3
3.2.1-3ubuntu0.1~esm1
smarty3
Ubuntu:22.04:LTS
 before 3.1.39-2ubuntu1.22.04.2, plus listed versions
3.1.39-23.1.39-2ubuntu13.1.39-2ubuntu1.22.04.1
3.1.39-2ubuntu1.22.04.2
civicrm
Ubuntu:Pro:22.04:LTS
 before 5.33.2+dfsg1-1ubuntu1+esm1, plus listed versions
5.33.2+dfsg1-15.33.2+dfsg1-1build15.33.2+dfsg1-1ubuntu1
5.33.2+dfsg1-1ubuntu1+esm1
postfixadmin
Ubuntu:Pro:22.04:LTS
 before 3.3.10-2ubuntu0.1~esm1, plus listed versions
3.3.7-13.3.10-2
3.3.10-2ubuntu0.1~esm1
smarty3
Ubuntu:24.04:LTS
 before 3.1.48-1ubuntu0.24.04.1, plus listed versions
3.1.48-1
3.1.48-1ubuntu0.24.04.1
postfixadmin
Ubuntu:Pro:24.04:LTS
 before 3.3.13-1ubuntu0.1~esm1, plus listed versions
3.3.13-1
3.3.13-1ubuntu0.1~esm1
postfixadmin
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 3.0.2-2ubuntu0.1~esm1, plus listed versions
3.0.2-2
3.0.2-2ubuntu0.1~esm1
postfixadmin
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 3.2.1-3ubuntu0.1~esm1, plus listed versions
3.2.1-23.2.1-3
3.2.1-3ubuntu0.1~esm1
postfixadmin
Ubuntu:Pro:22.04:LTS
From an advisory covering 3 CVEs
 before 3.3.10-2ubuntu0.1~esm1, plus listed versions
3.3.7-13.3.10-2
3.3.10-2ubuntu0.1~esm1
smarty3
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1, plus listed versions
3.1.31+20161214.1.c7d42e4+selfpack1-23.1.31+20161214.1.c7d42e4+selfpack1-33.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1
3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1
smarty3
Ubuntu:20.04:LTS
From an advisory covering 3 CVEs
 before 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1, plus listed versions
3.1.33+20180830.1.3a78a21f+selfpack1-13.1.34+20190228.1.c9f0de05+selfpack1-1
3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1
smarty3
Ubuntu:22.04:LTS
From an advisory covering 3 CVEs
 before 3.1.39-2ubuntu1.22.04.2, plus listed versions
3.1.39-23.1.39-2ubuntu13.1.39-2ubuntu1.22.04.1
3.1.39-2ubuntu1.22.04.2
smarty3
Ubuntu:24.04:LTS
From an advisory covering 3 CVEs
 before 3.1.48-1ubuntu0.24.04.1, plus listed versions
3.1.48-1
3.1.48-1ubuntu0.24.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubdrkbcn/lblfixer_cve_2023_284472023-03-30

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28447 is a high vulnerability (CVSS 7.1) in Smarty, published March 28, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in smarty/smarty 4.3.1.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open