CVE-2024-35226
PHP Code Injection by malicious attribute in extends-tag in Smarty
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PHP Code Injection by malicious attribute in extends-tag in Smarty
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
- Record
CVE-2024-35226- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-1424
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-1424- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4rmg-292m-wg3w
Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag
Impact
Template authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.
Patches
Please upgrade to the most recent version of Smarty v4 or v5. There is no patch for v3.
- Record
GHSA-4rmg-292m-wg3w- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
- Record
CVE-2024-35226- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
PHP Code Injection by malicious attribute in extends-tag in Smarty
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
- Record
CVE-2024-35226- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-35226
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
- Record
DEBIAN-CVE-2024-35226- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-4rmg-292m-wg3w
Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag
Impact
Template authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.
Patches
Please upgrade to the most recent version of Smarty v4 or v5. There is no patch for v3.
- Record
GHSA-4rmg-292m-wg3w- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-35226
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
- Record
UBUNTU-CVE-2024-35226- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUSN-7158-1 No score
smarty3 vulnerabilities
It was discovered that Smarty incorrectly handled query parameters in requests. An attacker could possibly use this issue to inject arbitrary Javascript code, resulting in denial of service or potential execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2018-25047, CVE-2023-28447)
It was discovered that Smarty did not properly sanitize user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. (CVE-2024-35226)
- Record
USN-7158-1- Updated
- 2026-11-02
OSVUSN-7377-1 No score
smarty vulnerability
It was discovered that Smarty did not properly sanitize template file names. An attacker could possibly use this issue to cause Smarty to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-7377-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
smarty/smartyPackagist |
5.0.0 up to 5.1.1 | 5.1.1 |
smarty/smartyPackagist |
3.0.0 up to 4.5.3 | 4.5.3 |
smarty3Debian:12 |
before 3.1.47-2+deb12u1, plus listed versions 3.1.47-2 |
3.1.47-2+deb12u1 |
smarty3Debian:13 |
before 3.1.48-2 | 3.1.48-2 |
smarty3Debian:14 |
before 3.1.48-2 | 3.1.48-2 |
smarty4Debian:12 |
before 4.3.0-1+deb12u2, plus listed versions 4.3.0-14.3.0-1+deb12u1 |
4.3.0-1+deb12u2 |
smarty4Debian:13 |
before 4.5.4-1 | 4.5.4-1 |
smarty4Debian:14 |
before 4.5.4-1 | 4.5.4-1 |
smarty3Debian:11 From an advisory covering 3 CVEs |
before 3.1.39-2+deb11u2, plus listed versions 3.1.39-13.1.39-23.1.39-2+deb11u1 |
3.1.39-2+deb11u2 |
smarty3Debian:12 From an advisory covering 2 CVEs |
before 3.1.47-2+deb12u1, plus listed versions 3.1.47-2 |
3.1.47-2+deb12u1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
smarty/smartyPackagist |
5.0.0 up to 5.1.1, plus listed versions v5.0.0v5.0.1v5.0.2v5.1.0 |
5.1.1 |
smarty/smartyPackagist |
3.0.0 up to 4.5.3, plus listed versions v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15 Show 45 moreShow lessv3.1.16v3.1.17v3.1.18v3.1.19v3.1.20v3.1.21v3.1.23v3.1.24v3.1.25v3.1.26v3.1.27v3.1.28v3.1.29v3.1.30v3.1.31v3.1.32v3.1.33v3.1.34v3.1.35v3.1.36v3.1.37v3.1.37.1v3.1.38v3.1.39v3.1.40v3.1.41v3.1.42v3.1.43v3.1.44v3.1.45v3.1.46v3.1.47v3.1.48v4.0.0v4.0.0-rc.0v4.0.1v4.0.2v4.0.3v4.0.4v4.1.0v4.1.1v4.2.0v4.2.1v4.3.0v4.3.1 |
4.5.3 |
smarty3Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.1.21-13.1.21-1ubuntu13.1.21-1ubuntu1+esm13.1.21-1ubuntu1+esm2 |
None known |
smarty3Ubuntu:Pro:18.04:LTS |
before 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1, plus listed versions 3.1.31+20161214.1.c7d42e4+selfpack1-23.1.31+20161214.1.c7d42e4+selfpack1-33.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1 |
3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1 |
smarty3Ubuntu:20.04:LTS |
before 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1, plus listed versions 3.1.33+20180830.1.3a78a21f+selfpack1-13.1.34+20190228.1.c9f0de05+selfpack1-1 |
3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1 |
smarty3Ubuntu:22.04:LTS |
before 3.1.39-2ubuntu1.22.04.2, plus listed versions 3.1.39-23.1.39-2ubuntu13.1.39-2ubuntu1.22.04.1 |
3.1.39-2ubuntu1.22.04.2 |
smarty3Ubuntu:24.04:LTS |
before 3.1.48-1ubuntu0.24.04.1, plus listed versions 3.1.48-1 |
3.1.48-1ubuntu0.24.04.1 |
smarty4Ubuntu:24.04:LTS |
before 4.3.1-1ubuntu0.24.04.1, plus listed versions 4.3.1-1 |
4.3.1-1ubuntu0.24.04.1 |
smarty3Ubuntu:25.10 |
All versions, plus listed versions 3.1.48-2 |
None known |
smarty3Ubuntu:26.10 |
All versions, plus listed versions 3.1.48-2build1 |
None known |
smarty3Ubuntu:26.04:LTS |
All versions, plus listed versions 3.1.48-23.1.48-2build1 |
None known |
smarty3Ubuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1, plus listed versions 3.1.31+20161214.1.c7d42e4+selfpack1-23.1.31+20161214.1.c7d42e4+selfpack1-33.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1 |
3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1 |
smarty3Ubuntu:20.04:LTS From an advisory covering 3 CVEs |
before 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1, plus listed versions 3.1.33+20180830.1.3a78a21f+selfpack1-13.1.34+20190228.1.c9f0de05+selfpack1-1 |
3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1 |
smarty3Ubuntu:22.04:LTS From an advisory covering 3 CVEs |
before 3.1.39-2ubuntu1.22.04.2, plus listed versions 3.1.39-23.1.39-2ubuntu13.1.39-2ubuntu1.22.04.1 |
3.1.39-2ubuntu1.22.04.2 |
smarty3Ubuntu:24.04:LTS From an advisory covering 3 CVEs |
before 3.1.48-1ubuntu0.24.04.1, plus listed versions 3.1.48-1 |
3.1.48-1ubuntu0.24.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-35226 is a high vulnerability (CVSS 7.3) in Smarty-php Smarty, published May 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in smarty/smarty 5.1.1.
References
github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w
lists.debian.org/debian-lts-announce/2024/11/msg00013.html
nvd.nist.gov/vuln/detail/CVE-2024-35226
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2024-35226
ubuntu.com/security/CVE-2024-35226
cve.org/CVERecord?id=CVE-2024-35226
Left out here: 9 versions. The JSON record has them.