{"id":"CVE-2021-26119","aliases":["DEBIAN-CVE-2021-26119","DLA-2618-1","EUVD-2021-0717","GHSA-w5hr-jm4j-9jvq","MGASA-2021-0335","MGASA-2022-0127","UBUNTU-CVE-2021-26119","USN-5348-1","USN-5348-2","USN-5348-3"],"status":"published","title":"Sandbox escape through template_object in smarty","description":"Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.08494,"percentile":0.95111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-02-22T01:34:05Z","modified":"2026-10-23T18:02:41Z","fixes":[{"ecosystem":"Packagist","package":"smarty/smarty","fixed_in":["3.1.39"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"smarty3","fixed_in":["3.1.39-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty3","fixed_in":["3.1.39-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty3","fixed_in":["3.1.39-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","fixed_in":["3.1.21-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"smarty3","fixed_in":["3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u2"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u1"],"bundled":4},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39"}]}],"versions":["v2.6.24","v2.6.25","v2.6.26","v2.6.27","v2.6.28","v2.6.29","v2.6.30","v2.6.31","v2.6.33","v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.20","v3.1.21","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.30","v3.1.31","v3.1.32","v3.1.33","v3.1.34","v3.1.35","v3.1.36","v3.1.37","v3.1.37.1","v3.1.38"]},{"source":"osv","ecosystem":"Mageia:7","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.4-1.mga8"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-1ubuntu1+esm1"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-1ubuntu1+esm1"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"smarty","product":"smarty"}],"references":[{"url":"https://github.com/smarty-php/smarty/blob/master/CHANGELOG.md","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00004.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00014.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202105-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.debian.org/security/2022/dsa-5151","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-w5hr-jm4j-9jvq","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26119","tags":["advisory"]},{"url":"https://srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-26119.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w5hr-jm4j-9jvq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-26119","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2021-0335.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28996","tags":["report"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.39","tags":["web"]},{"url":"https://www.debian.org/lts/security/2021/dla-2618","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0127.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30214","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5348-1","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.0.4","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-26119","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5348-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5348-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-13982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-29454","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-26119","description":"Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.","status":"published","published":"2021-02-22T01:34:05Z","modified":"2024-08-03T20:19:20.153Z","updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-0717","description":"Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.","status":"published","published":"2021-02-22T01:34:05Z","modified":"2024-08-03T20:19:20Z","updated_at":"2026-11-03T03:24:51.962182Z"}],"ghsa":[{"id":"GHSA-w5hr-jm4j-9jvq","title":"Sandbox escape through template_object in smarty","description":"Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on [Smarty Security features](https://www.smarty.net/docs/en/advanced.features.tpl) should upgrade as soon as possible. Please upgrade to 3.1.39 or higher.","status":"published","published":"2021-03-02T02:57:23Z","modified":"2024-02-07T18:46:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:37:36.777238Z"}],"nvd":[{"id":"CVE-2021-26119","description":"Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.","status":"published","published":"2021-02-22T02:15:14.26Z","modified":"2026-06-17T03:42:53.89Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"CVE-2021-26119","description":"Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.","status":"published","published":"2021-02-22T02:15:14.26Z","modified":"2026-10-20T10:53:40.287891225Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-26119","description":"Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.","status":"published","published":"2021-02-22T02:15:14.26Z","modified":"2026-10-23T18:02:41.108039716Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-w5hr-jm4j-9jvq","title":"Sandbox escape through template_object in smarty","description":"Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on [Smarty Security features](https://www.smarty.net/docs/en/advanced.features.tpl) should upgrade as soon as possible. Please upgrade to 3.1.39 or higher.","status":"published","published":"2021-03-02T02:57:23Z","modified":"2024-12-03T06:08:49.026212Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2021-26119","description":"Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.","status":"published","published":"2021-02-22T02:15:00Z","modified":"2026-02-04T02:56:09.042229Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-2618-1","title":"smarty3 - security update","status":"published","published":"2021-04-05T00:00:00Z","modified":"2026-03-09T01:21:20.231278Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0335","title":"Updated php-smarty package fixes security vulnerabilities","description":"Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object\ncan be accessed in sandbox mode (CVE-2021-26119).\n\nSmarty before 3.1.39 allows code injection via an unexpected function name\nafter a {function name= substring (CVE-2021-26120).\n","status":"published","published":"2021-07-10T20:00:34Z","modified":"2026-04-16T04:41:15.081208166Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"MGASA-2022-0127","title":"Updated php-smarty packages fix security vulnerability","description":"Updated php-smarty packages to version 4 for php 8 compatibility and to\nfix security vulnerabilities.\n","status":"published","published":"2022-04-02T22:22:09Z","modified":"2026-04-16T04:41:10.798496633Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"USN-5348-1","title":"smarty3 vulnerabilities","description":"David Gnedt and Thomas Konrad discovered that Smarty was incorrectly\nsanitizing the paths present in the templates. An attacker could possibly\nuse this use to read arbitrary files when controlling the executed\ntemplate. (CVE-2018-13982)\n\nIt was discovered that Smarty was incorrectly sanitizing the paths\npresent in the templates. An attacker could possibly use this use to read\narbitrary files when controlling the executed template. (CVE-2018-16831)\n\nIt was discovered that Smarty was incorrectly validating security policy\ndata, allowing the execution of static classes even when not permitted by\nthe security settings. An attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2021-21408)\n\nIt was discovered that Smarty was incorrectly managing access control to\ntemplate objects, which allowed users to perform a sandbox escape. An\nattacker could possibly use this issue to send specially crafted input to\napplications that use Smarty and execute arbitrary code. (CVE-2021-26119)\n\nIt was discovered that Smarty was not checking for special characters\nwhen setting function names during plugin compile operations. An attacker\ncould possibly use this issue to send specially crafted input to\napplications that use Smarty and execute arbitrary code. (CVE-2021-26120)\n\nIt was discovered that Smarty was incorrectly sanitizing characters in\nmath strings processed by the math function. An attacker could possibly\nuse this issue to send specially crafted input to applications that use\nSmarty and execute arbitrary code. (CVE-2021-29454)\n","status":"published","published":"2022-03-28T10:09:49Z","modified":"2026-02-10T04:42:32Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5348-2","title":"smarty3 vulnerabilities","description":"USN-5348-1 fixed several vulnerabilities in Smarty. This update provides\nthe fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and\nCVE-2021-29454 for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n David Gnedt and Thomas Konrad discovered that Smarty was incorrectly\n sanitizing the paths present in the templates. An attacker could possibly\n use this use to read arbitrary files when controlling the executed\n template. (CVE-2018-13982)\n\n It was discovered that Smarty was incorrectly sanitizing the paths\n present in the templates. An attacker could possibly use this use to read\n arbitrary files when controlling the executed template. (CVE-2018-16831)\n\n It was discovered that Smarty was incorrectly validating security policy\n data, allowing the execution of static classes even when not permitted by\n the security settings. An attacker could possibly use this issue to\n execute arbitrary code. (CVE-2021-21408)\n\n It was discovered that Smarty was incorrectly managing access control to\n template objects, which allowed users to perform a sandbox escape. An\n attacker could possibly use this issue to send specially crafted input to\n applications that use Smarty and execute arbitrary code. (CVE-2021-26119)\n\n It was discovered that Smarty was not checking for special characters\n when setting function names during plugin compile operations. An attacker\n could possibly use this issue to send specially crafted input to\n applications that use Smarty and execute arbitrary code. (CVE-2021-26120)\n\n It was discovered that Smarty was incorrectly sanitizing characters in\n math strings processed by the math function. An attacker could possibly\n use this issue to send specially crafted input to applications that use\n Smarty and execute arbitrary code. (CVE-2021-29454)\n","status":"published","published":"2022-03-28T13:22:18Z","modified":"2026-06-25T13:31:06.155746858Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5348-3","title":"smarty3 vulnerabilities","description":"USN-5348-1 fixed several vulnerabilities in Smarty. This update provides\nthe fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and\nCVE-2021-29454 for Ubuntu 20.04 ESM.\n\nOriginal advisory details:\n\n David Gnedt and Thomas Konrad discovered that Smarty was incorrectly\n sanitizing the paths present in the templates. An attacker could possibly\n use this use to read arbitrary files when controlling the executed\n template. (CVE-2018-13982)\n\n It was discovered that Smarty was incorrectly sanitizing the paths\n present in the templates. An attacker could possibly use this use to read\n arbitrary files when controlling the executed template. (CVE-2018-16831)\n\n It was discovered that Smarty was incorrectly validating security policy\n data, allowing the execution of static classes even when not permitted by\n the security settings. An attacker could possibly use this issue to\n execute arbitrary code. (CVE-2021-21408)\n\n It was discovered that Smarty was incorrectly managing access control to\n template objects, which allowed users to perform a sandbox escape. An\n attacker could possibly use this issue to send specially crafted input to\n applications that use Smarty and execute arbitrary code. (CVE-2021-26119)\n\n It was discovered that Smarty was not checking for special characters\n when setting function names during plugin compile operations. An attacker\n could possibly use this issue to send specially crafted input to\n applications that use Smarty and execute arbitrary code. (CVE-2021-26120)\n\n It was discovered that Smarty was incorrectly sanitizing characters in\n math strings processed by the math function. An attacker could possibly\n use this issue to send specially crafted input to applications that use\n Smarty and execute arbitrary code. (CVE-2021-29454)\n","status":"published","published":"2022-06-21T15:29:25Z","modified":"2026-02-10T04:42:32Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}