Every CVE Search/ Get API key

CVE-2026-82531

Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

9.2 CriticalPublic exploit

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.82%Unchanged since Oct 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Record
CVE-2026-82531
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2026-93376 9.2

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Record
EUVD-2026-93376
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 9.2

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Record
CVE-2026-82531
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 9.2

Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Record
CVE-2026-82531
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-94
Updated
2026-11-02
OSVDEBIAN-CVE-2026-82531 8.1

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Record
DEBIAN-CVE-2026-82531
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-82531 9.2

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Record
UBUNTU-CVE-2026-82531
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
smarty3
Debian:12
 All versions, plus listed versions
3.1.47-23.1.47-2+deb12u13.1.48-13.1.48-2
 None known
smarty3
Debian:13
 All versions, plus listed versions
3.1.48-2
 None known
smarty3
Debian:14
 All versions, plus listed versions
3.1.48-2
 None known
smarty4
Debian:12
 All versions, plus listed versions
4.3.0-14.3.0-1+deb12u14.3.0-1+deb12u24.3.1-14.5.4-14.5.5-1
 None known
smarty4
Debian:13
 All versions, plus listed versions
4.5.5-1
 None known
smarty4
Debian:14
 All versions, plus listed versions
4.5.5-1
 None known
smarty3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.21-13.1.21-1ubuntu13.1.21-1ubuntu1+esm13.1.21-1ubuntu1+esm2
 None known
smarty3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.31+20161214.1.c7d42e4+selfpack1-23.1.31+20161214.1.c7d42e4+selfpack1-33.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.13.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1
 None known
smarty3
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.1.33+20180830.1.3a78a21f+selfpack1-13.1.34+20190228.1.c9f0de05+selfpack1-13.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm13.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.13.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1+esm1
 None known
smarty3
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.1.39-23.1.39-2ubuntu13.1.39-2ubuntu1.22.04.13.1.39-2ubuntu1.22.04.2
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
smarty3
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.1.48-13.1.48-1ubuntu0.24.04.1
 None known
smarty4
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.3.1-14.3.1-1ubuntu0.24.04.1
 None known
smarty3
Ubuntu:26.10
 All versions, plus listed versions
3.1.48-2build1
 None known
smarty4
Ubuntu:26.10
 All versions, plus listed versions
4.5.5-1
 None known
smarty3
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.48-23.1.48-2build1
 None known
smarty4
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.5.5-1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmurrez/CVE-2026-825312026-10-07

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-82531 is a critical vulnerability (CVSS 9.2) in Smarty-php Smarty, published October 6, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. No source names a fixed version.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open