{"id":"CVE-2018-13982","aliases":["DEBIAN-CVE-2018-13982","DLA-2618-1","EUVD-2022-2995","GHSA-7gfx-wxfh-7rvm","MGASA-2018-0403","MGASA-2022-0127","UBUNTU-CVE-2018-13982","USN-5348-1"],"status":"published","title":"Smarty Path Traversal Vulnerability","description":"Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03463,"percentile":0.89131,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2018-09-18T21:00:00Z","modified":"2026-10-23T18:02:58Z","fixes":[{"ecosystem":"Packagist","package":"smarty/smarty","fixed_in":["3.1.33"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"smarty3","fixed_in":["3.1.33+20180830.1.3a78a21f+selfpack1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty3","fixed_in":["3.1.33+20180830.1.3a78a21f+selfpack1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty3","fixed_in":["3.1.33+20180830.1.3a78a21f+selfpack1-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"php-smarty","fixed_in":["3.1.33-1.2.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.33"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.33+20180830.1.3a78a21f+selfpack1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.33+20180830.1.3a78a21f+selfpack1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.33+20180830.1.3a78a21f+selfpack1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u2"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u1"],"bundled":4},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.33"}]}],"versions":["v2.6.24","v2.6.25","v2.6.26","v2.6.27","v2.6.28","v2.6.29","v2.6.30","v2.6.31","v2.6.33","v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.20","v3.1.21","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.30","v3.1.31","v3.1.32"]},{"source":"osv","ecosystem":"Mageia:6","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.33-1.2.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.4-1.mga8"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3"],"bundled":6}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"smarty","product":"smarty"}],"references":[{"url":"https://github.com/smarty-php/smarty/commit/2e081a51b1effddb23f87952959139ac62654d50","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/smarty-php/smarty/commit/f9ca3c63d1250bb56b2bda609dcc9dd81f0065f8","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/smarty-php/smarty/commit/c9dbe1d08c081912d02bd851d1d1b6388f6133d1","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/smarty-php/smarty/commit/8d21f38dc35c4cd6b31c2f23fc9b8e5adbc56dfe","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/smarty-php/smarty/commit/bcedfd6b58bed4a7366336979ebaa5a240581531","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180420-01_Smarty_Path_Traversal","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00004.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00014.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-13982","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2018-13982.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7gfx-wxfh-7rvm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-13982","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2018-0403.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23592","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2018/09/17/4","tags":["web","report"]},{"url":"https://advisories.mageia.org/MGASA-2022-0127.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30214","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5348-1","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.0.4","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-13982","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-13982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29454","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-13982","description":"Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.","status":"published","published":"2018-09-18T21:00:00Z","modified":"2024-08-05T09:21:40.766Z","updated_at":"2026-11-02T14:35:07.01498Z"}],"euvd":[{"id":"EUVD-2022-2995","description":"Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.","status":"published","published":"2018-09-18T21:00:00Z","modified":"2024-08-05T09:21:40Z","updated_at":"2026-11-03T02:39:47.770292Z"}],"ghsa":[{"id":"GHSA-7gfx-wxfh-7rvm","title":"Smarty Path Traversal Vulnerability","description":"`Smarty_Security::isTrustedResourceDir()` in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.","status":"published","published":"2022-05-13T01:05:24Z","modified":"2024-02-07T18:46:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:36.777238Z"}],"nvd":[{"id":"CVE-2018-13982","description":"Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.","status":"published","published":"2018-09-18T21:29:02.247Z","modified":"2026-06-17T01:40:25.827Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"CVE-2018-13982","description":"Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.","status":"published","published":"2018-09-18T21:29:02.247Z","modified":"2026-10-20T10:50:01.256141232Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-13982","description":"Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.","status":"published","published":"2018-09-18T21:29:02.247Z","modified":"2026-10-23T18:02:58.942385863Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"GHSA-7gfx-wxfh-7rvm","title":"Smarty Path Traversal Vulnerability","description":"`Smarty_Security::isTrustedResourceDir()` in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.","status":"published","published":"2022-05-13T01:05:24Z","modified":"2024-02-16T08:20:09.343264Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2018-13982","description":"Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.","status":"published","published":"2018-09-18T21:29:00Z","modified":"2026-02-04T04:23:20.966121Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-2618-1","title":"smarty3 - security update","status":"published","published":"2021-04-05T00:00:00Z","modified":"2026-03-09T01:21:20.231278Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2018-0403","title":"Updated php-smarty packages fix security vulnerability","description":"Smarty 3.1.32 or below is prone to a path traversal vulnerability due to\ninsufficient template code sanitization. This allows attackers controlling\nthe executed template code to bypass the trusted directory security\nrestriction and read arbitrary files (CVE-2018-13982).\n","status":"published","published":"2018-10-19T18:00:37Z","modified":"2026-04-16T06:22:51.374126526Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2022-0127","title":"Updated php-smarty packages fix security vulnerability","description":"Updated php-smarty packages to version 4 for php 8 compatibility and to\nfix security vulnerabilities.\n","status":"published","published":"2022-04-02T22:22:09Z","modified":"2026-04-16T04:41:10.798496633Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"USN-5348-1","title":"smarty3 vulnerabilities","description":"David Gnedt and Thomas Konrad discovered that Smarty was incorrectly\nsanitizing the paths present in the templates. An attacker could possibly\nuse this use to read arbitrary files when controlling the executed\ntemplate. (CVE-2018-13982)\n\nIt was discovered that Smarty was incorrectly sanitizing the paths\npresent in the templates. An attacker could possibly use this use to read\narbitrary files when controlling the executed template. (CVE-2018-16831)\n\nIt was discovered that Smarty was incorrectly validating security policy\ndata, allowing the execution of static classes even when not permitted by\nthe security settings. An attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2021-21408)\n\nIt was discovered that Smarty was incorrectly managing access control to\ntemplate objects, which allowed users to perform a sandbox escape. An\nattacker could possibly use this issue to send specially crafted input to\napplications that use Smarty and execute arbitrary code. (CVE-2021-26119)\n\nIt was discovered that Smarty was not checking for special characters\nwhen setting function names during plugin compile operations. An attacker\ncould possibly use this issue to send specially crafted input to\napplications that use Smarty and execute arbitrary code. (CVE-2021-26120)\n\nIt was discovered that Smarty was incorrectly sanitizing characters in\nmath strings processed by the math function. An attacker could possibly\nuse this issue to send specially crafted input to applications that use\nSmarty and execute arbitrary code. (CVE-2021-29454)\n","status":"published","published":"2022-03-28T10:09:49Z","modified":"2026-02-10T04:42:32Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}