{"id":"CVE-2018-25047","aliases":["DEBIAN-CVE-2018-25047","DLA-3262-1","DLA-3956-1","EUVD-2022-6844","GHSA-hwq7-5vv9-c6cf","MGASA-2023-0014","UBUNTU-CVE-2018-25047","USN-7158-1"],"status":"published","title":"Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto","description":"In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01174,"percentile":0.6771,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-09-14T00:00:00Z","modified":"2026-10-23T18:04:47Z","fixes":[{"ecosystem":"Packagist","package":"smarty/smarty","fixed_in":["3.1.47","4.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"smarty3","fixed_in":["3.1.47-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty3","fixed_in":["3.1.47-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty3","fixed_in":["3.1.47-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"smarty4","fixed_in":["4.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty4","fixed_in":["4.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty4","fixed_in":["4.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"smarty3","fixed_in":["3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"php-smarty","fixed_in":["4.2.1-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"smarty3","fixed_in":["3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","fixed_in":["3.1.39-2ubuntu1.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"smarty3","fixed_in":["3.1.48-1ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u2"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u1"]},{"source":"osv","ecosystem":"Debian:11","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2+deb11u2"}]}],"versions":["3.1.39-1","3.1.39-2","3.1.39-2+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47"}]}],"versions":["v2.6.24","v2.6.25","v2.6.26","v2.6.27","v2.6.28","v2.6.29","v2.6.30","v2.6.31","v2.6.33","v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.20","v3.1.21","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.30","v3.1.31","v3.1.32","v3.1.33","v3.1.34","v3.1.35","v3.1.36","v3.1.37","v3.1.37.1","v3.1.38","v3.1.39","v3.1.40","v3.1.41","v3.1.42","v3.1.43","v3.1.44","v3.1.45","v3.1.46"]},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.2.1"}]}],"versions":["v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.1.0","v4.1.1","v4.2.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1","3.1.21-1ubuntu1+esm1","3.1.21-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3","3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2ubuntu1.22.04.2"}]}],"versions":["3.1.39-2","3.1.39-2ubuntu1","3.1.39-2ubuntu1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-1ubuntu0.24.04.1"}]}],"versions":["3.1.48-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.48-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.48-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.48-2","3.1.48-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3","3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2ubuntu1.22.04.2"}]}],"versions":["3.1.39-2","3.1.39-2ubuntu1","3.1.39-2ubuntu1.22.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-1ubuntu0.24.04.1"}]}],"versions":["3.1.48-1"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"smarty","product":"smarty"}],"references":[{"url":"https://github.com/smarty-php/smarty/issues/454","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.2.1","tags":["x_transferred","Release Notes","advisory","web","report"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.47","tags":["x_transferred","Release Notes","advisory","web","report"]},{"url":"https://bugs.gentoo.org/870100","tags":["x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security.gentoo.org/glsa/202209-09","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00002.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25047","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty/commit/55ea25d1f50f0406fb1ccedd212c527977793fc9","tags":["web","report"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2018-25047.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hwq7-5vv9-c6cf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-25047","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0014.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31387","tags":["report"]},{"url":"https://www.debian.org/lts/security/2023/dla-3262","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-25047","tags":["report"]},{"url":"https://github.com/smarty-php/smarty/commit/f1f7ee6e34c14a8a9dfa5c6ef894d39277a93938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-25047","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7158-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35226","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-25047","description":"In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.","status":"published","published":"2022-09-14T00:00:00Z","modified":"2025-11-03T21:44:10.223Z","updated_at":"2026-11-02T14:35:01.952568Z"}],"euvd":[{"id":"EUVD-2022-6844","description":"In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.","status":"published","published":"2022-09-14T00:00:00Z","modified":"2025-11-03T21:44:10Z","updated_at":"2026-11-02T19:49:31.7352Z"}],"ghsa":[{"id":"GHSA-hwq7-5vv9-c6cf","title":"Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto","description":"In Smarty before 3.1.47 and 4.x before 4.2.1, `libs/plugins/function.mailto.php` allows cross-site scripting. A web page that uses `smarty_function_mailto`, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.","status":"published","published":"2022-09-16T00:00:39Z","modified":"2025-11-04T16:39:37Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2018-25047","description":"In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.","status":"published","published":"2022-09-15T00:15:09.58Z","modified":"2026-06-17T01:54:35.997Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:00.565712Z"}],"osv":[{"id":"CVE-2018-25047","description":"In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.","status":"published","published":"2022-09-15T00:15:09.58Z","modified":"2026-10-20T10:51:26.369283507Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-25047","description":"In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.","status":"published","published":"2022-09-15T00:15:09.58Z","modified":"2026-10-23T18:04:47.627954621Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"GHSA-hwq7-5vv9-c6cf","title":"Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto","description":"In Smarty before 3.1.47 and 4.x before 4.2.1, `libs/plugins/function.mailto.php` allows cross-site scripting. A web page that uses `smarty_function_mailto`, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.","status":"published","published":"2022-09-16T00:00:39Z","modified":"2025-11-04T17:01:44.419323Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"UBUNTU-CVE-2018-25047","description":"In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.","status":"published","published":"2022-09-15T00:15:00Z","modified":"2026-10-17T12:55:27.018254069Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"DLA-3262-1","title":"smarty3 - security update","status":"published","published":"2023-01-05T00:00:00Z","modified":"2026-03-09T01:21:04.200903Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3956-1","title":"smarty3 - security update","status":"published","published":"2024-11-17T00:00:00Z","modified":"2026-03-09T01:21:13.388555Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2023-0014","title":"Updated php-smarty packages fix security vulnerability","description":"It was discovered that there was a potential cross-site scripting\nvulnerability in smarty3, a widely-used PHP templating engine.\n\nIn Smarty before 3.1.47 and 4.x before 4.2.1,\nlibs/plugins/function.mailto.php allows XSS. A web page that uses\nsmarty_function_mailto, and that could be parameterized using GET or POST\ninput parameters, could allow injection of JavaScript code by a user.\n(CVE-2018-25047)\n","status":"published","published":"2023-01-24T07:58:24Z","modified":"2026-04-16T04:41:04.289227526Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-7158-1","title":"smarty3 vulnerabilities","description":"It was discovered that Smarty incorrectly handled query parameters in\nrequests. An attacker could possibly use this issue to inject arbitrary\nJavascript code, resulting in denial of service or potential execution of\narbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2018-25047, CVE-2023-28447)\n\nIt was discovered that Smarty did not properly sanitize user input when\ngenerating templates. An attacker could, through PHP injection, possibly\nuse this issue to execute arbitrary code. (CVE-2024-35226)\n","status":"published","published":"2024-12-12T21:51:34Z","modified":"2026-04-27T17:36:53.800249Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}