{"id":"CVE-2017-1000480","aliases":["DEBIAN-CVE-2017-1000480","DLA-1249-1","DSA-4094-1","EUVD-2022-3409","GHSA-9m49-vhwv-422g","MGASA-2018-0118","UBUNTU-CVE-2017-1000480"],"status":"published","title":"Smarty PHP code injection","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03124,"percentile":0.87944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2018-01-03T18:00:00Z","modified":"2026-10-20T10:47:33Z","fixes":[{"ecosystem":"Packagist","package":"smarty/smarty","fixed_in":["3.1.32"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"smarty3","fixed_in":["3.1.10-2+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"smarty3","fixed_in":["3.1.21-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"php-smarty","fixed_in":["3.1.21-1.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"php-smarty","fixed_in":["3.1.21-3.1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3"},{"fixed":"3.1.32"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-2+deb7u2"}]}],"versions":["3.1.10-2","3.1.10-2+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-1+deb8u1"}]}],"versions":["3.1.21-1"]},{"source":"osv","ecosystem":"Debian:9","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2"]},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3"},{"fixed":"3.1.32"}]}],"versions":["v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.20","v3.1.21","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.30","v3.1.31"]},{"source":"osv","ecosystem":"Mageia:5","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-3.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1","3.1.21-1ubuntu1+esm1","3.1.21-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2"]}],"products":[{"vendor":"smarty","product":"smarty"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4094","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://github.com/smarty-php/smarty/blob/master/change_log.txt","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00023.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00000.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000480","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9m49-vhwv-422g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-1000480","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2018-0118.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000480","tags":["report"]},{"url":"https://github.com/smarty-php/smarty/commit/614ad1f8b9b00086efc123e49b7bb8efbfa81b61","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000480","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-1000480","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.","status":"published","published":"2018-01-03T18:00:00Z","modified":"2024-08-05T22:00:41.503Z","updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2022-3409","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.","status":"published","published":"2018-01-03T18:00:00Z","modified":"2024-08-05T22:00:41Z","updated_at":"2026-11-03T02:23:03.159581Z"}],"ghsa":[{"id":"GHSA-9m49-vhwv-422g","title":"Smarty PHP code injection","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.","status":"published","published":"2022-05-14T03:46:35Z","modified":"2024-04-24T22:53:40Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:46.667202Z"}],"nvd":[{"id":"CVE-2017-1000480","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.","status":"published","published":"2018-01-03T18:29:00.37Z","modified":"2026-06-17T00:59:14.703Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:04:12.690425Z"}],"osv":[{"id":"CVE-2017-1000480","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.","status":"published","published":"2018-01-03T18:29:00.37Z","modified":"2026-10-20T10:47:33.458829421Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-1000480","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.","status":"published","published":"2018-01-03T18:29:00.37Z","modified":"2026-09-01T20:03:40.890492288Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"GHSA-9m49-vhwv-422g","title":"Smarty PHP code injection","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.","status":"published","published":"2022-05-14T03:46:35Z","modified":"2024-04-24T23:11:41.585135Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"UBUNTU-CVE-2017-1000480","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.","status":"published","published":"2018-01-03T18:29:00Z","modified":"2026-05-20T16:03:15.465928481Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1249-1","title":"smarty3 - security update","status":"published","published":"2018-01-19T00:00:00Z","modified":"2026-03-09T01:00:41.609184Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4094-1","title":"smarty3 - security update","status":"published","published":"2018-01-22T00:00:00Z","modified":"2026-03-09T01:19:43.531737Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0118","title":"Updated php-smarty packages fix security vulnerability","description":"Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling\nfetch() or display() functions on custom resources that does not sanitize\ntemplate name(CVE-2017-1000480).\n","status":"published","published":"2018-02-06T15:35:11Z","modified":"2026-04-16T06:23:45.025625893Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}