{"id":"CVE-2021-29454","aliases":["DEBIAN-CVE-2021-29454","DLA-2995-1","DSA-5151-1","EUVD-2022-0423","GHSA-29gp-2c3m-3j6m","MGASA-2022-0127","UBUNTU-CVE-2021-29454","USN-5348-1","USN-5348-2","USN-5348-3"],"status":"published","title":"Sandbox Escape by math function in smarty","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01861,"percentile":0.79394,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2022-01-10T00:00:00Z","modified":"2026-10-23T18:03:08Z","fixes":[{"ecosystem":"Packagist","package":"smarty/smarty","fixed_in":["3.1.42","4.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"smarty3","fixed_in":["3.1.45-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty3","fixed_in":["3.1.45-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty3","fixed_in":["3.1.45-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"smarty4","fixed_in":["4.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty4","fixed_in":["4.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty4","fixed_in":["4.1.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","fixed_in":["3.1.21-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"smarty3","fixed_in":["3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","fixed_in":["3.1.39-2ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.42"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u5"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u1","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u2","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u3","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u4"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2+deb11u1"}]}],"versions":["3.1.39-1","3.1.39-2"],"bundled":3},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.42"}]}],"versions":["v2.6.24","v2.6.25","v2.6.26","v2.6.27","v2.6.28","v2.6.29","v2.6.30","v2.6.31","v2.6.33","v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.20","v3.1.21","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.30","v3.1.31","v3.1.32","v3.1.33","v3.1.34","v3.1.35","v3.1.36","v3.1.37","v3.1.37.1","v3.1.38","v3.1.39","v3.1.40","v3.1.41"]},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]}],"versions":["v4.0.0","v4.0.1"]},{"source":"osv","ecosystem":"Mageia:8","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.4-1.mga8"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-1ubuntu1+esm1"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2ubuntu1"}]}],"versions":["3.1.39-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-1ubuntu1+esm1"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"smarty","product":"smarty"},{"vendor":"smarty-php","product":"smarty"}],"references":[{"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-29gp-2c3m-3j6m","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/smarty-php/smarty/commit/215d81a9fa3cd63d82fb3ab56ecaf97cf1e7db71","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.42","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.0.2","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://packagist.org/packages/smarty/smarty","tags":["x_transferred","Product","Third Party Advisory","advisory","web","report"]},{"url":"https://www.smarty.net/docs/en/language.function.math.tpl","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2022/dsa-5151","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202209-09","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29454","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-29454.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-29gp-2c3m-3j6m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-29454","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0127.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30214","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5348-1","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.0.4","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-29454","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5348-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5348-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-13982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-26120","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-29454","title":"Sandbox Escape by math function in smarty","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.","status":"published","published":"2022-01-10T00:00:00Z","modified":"2025-04-23T19:14:05.629Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:33:06.32268Z"}],"euvd":[{"id":"EUVD-2022-0423","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.","status":"published","published":"2022-01-10T00:00:00Z","modified":"2025-04-23T19:14:05Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:06.891582Z"}],"ghsa":[{"id":"GHSA-29gp-2c3m-3j6m","title":"Sandbox Escape by math function in smarty","description":"### Impact\nTemplate authors could run arbitrary PHP code by crafting a malicious math string.\nIf a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.\n\n### Patches\nPlease upgrade to 4.0.2 or 3.1.42 or higher.\n\n### References\nSee [documentation on Math function](https://www.smarty.net/docs/en/language.function.math.tpl).\n\n### For more information\nIf you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)\n","status":"published","published":"2022-01-12T22:43:00Z","modified":"2024-02-07T18:46:21Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:36.777238Z"}],"nvd":[{"id":"CVE-2021-29454","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.","status":"published","published":"2022-01-10T20:15:08Z","modified":"2026-06-17T03:47:40.45Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:03.418194Z"}],"osv":[{"id":"CVE-2021-29454","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.","status":"published","published":"2022-01-10T20:15:08Z","modified":"2026-10-20T10:54:37.212015803Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-29454","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.","status":"published","published":"2022-01-10T20:15:08Z","modified":"2026-10-23T18:03:08.902736849Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-29gp-2c3m-3j6m","title":"Sandbox Escape by math function in smarty","description":"### Impact\nTemplate authors could run arbitrary PHP code by crafting a malicious math string.\nIf a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.\n\n### Patches\nPlease upgrade to 4.0.2 or 3.1.42 or higher.\n\n### References\nSee [documentation on Math function](https://www.smarty.net/docs/en/language.function.math.tpl).\n\n### For more information\nIf you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)\n","status":"published","published":"2022-01-12T22:43:00Z","modified":"2026-07-08T06:29:24.141924435Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"UBUNTU-CVE-2021-29454","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.","status":"published","published":"2022-01-10T20:15:00Z","modified":"2026-02-04T04:16:23.477129Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DLA-2995-1","title":"smarty3 - security update","status":"published","published":"2022-05-05T00:00:00Z","modified":"2026-03-09T01:23:05.567195Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5151-1","title":"smarty3 - security update","status":"published","published":"2022-05-29T00:00:00Z","modified":"2026-03-09T02:10:08.2205Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0127","title":"Updated php-smarty packages fix security vulnerability","description":"Updated php-smarty packages to version 4 for php 8 compatibility and to\nfix security vulnerabilities.\n","status":"published","published":"2022-04-02T22:22:09Z","modified":"2026-04-16T04:41:10.798496633Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"USN-5348-1","title":"smarty3 vulnerabilities","description":"David Gnedt and Thomas Konrad discovered that Smarty was incorrectly\nsanitizing the paths present in the templates. An attacker could possibly\nuse this use to read arbitrary files when controlling the executed\ntemplate. (CVE-2018-13982)\n\nIt was discovered that Smarty was incorrectly sanitizing the paths\npresent in the templates. An attacker could possibly use this use to read\narbitrary files when controlling the executed template. (CVE-2018-16831)\n\nIt was discovered that Smarty was incorrectly validating security policy\ndata, allowing the execution of static classes even when not permitted by\nthe security settings. An attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2021-21408)\n\nIt was discovered that Smarty was incorrectly managing access control to\ntemplate objects, which allowed users to perform a sandbox escape. An\nattacker could possibly use this issue to send specially crafted input to\napplications that use Smarty and execute arbitrary code. (CVE-2021-26119)\n\nIt was discovered that Smarty was not checking for special characters\nwhen setting function names during plugin compile operations. An attacker\ncould possibly use this issue to send specially crafted input to\napplications that use Smarty and execute arbitrary code. (CVE-2021-26120)\n\nIt was discovered that Smarty was incorrectly sanitizing characters in\nmath strings processed by the math function. An attacker could possibly\nuse this issue to send specially crafted input to applications that use\nSmarty and execute arbitrary code. (CVE-2021-29454)\n","status":"published","published":"2022-03-28T10:09:49Z","modified":"2026-02-10T04:42:32Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5348-2","title":"smarty3 vulnerabilities","description":"USN-5348-1 fixed several vulnerabilities in Smarty. This update provides\nthe fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and\nCVE-2021-29454 for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n David Gnedt and Thomas Konrad discovered that Smarty was incorrectly\n sanitizing the paths present in the templates. An attacker could possibly\n use this use to read arbitrary files when controlling the executed\n template. (CVE-2018-13982)\n\n It was discovered that Smarty was incorrectly sanitizing the paths\n present in the templates. An attacker could possibly use this use to read\n arbitrary files when controlling the executed template. (CVE-2018-16831)\n\n It was discovered that Smarty was incorrectly validating security policy\n data, allowing the execution of static classes even when not permitted by\n the security settings. An attacker could possibly use this issue to\n execute arbitrary code. (CVE-2021-21408)\n\n It was discovered that Smarty was incorrectly managing access control to\n template objects, which allowed users to perform a sandbox escape. An\n attacker could possibly use this issue to send specially crafted input to\n applications that use Smarty and execute arbitrary code. (CVE-2021-26119)\n\n It was discovered that Smarty was not checking for special characters\n when setting function names during plugin compile operations. An attacker\n could possibly use this issue to send specially crafted input to\n applications that use Smarty and execute arbitrary code. (CVE-2021-26120)\n\n It was discovered that Smarty was incorrectly sanitizing characters in\n math strings processed by the math function. An attacker could possibly\n use this issue to send specially crafted input to applications that use\n Smarty and execute arbitrary code. (CVE-2021-29454)\n","status":"published","published":"2022-03-28T13:22:18Z","modified":"2026-06-25T13:31:06.155746858Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5348-3","title":"smarty3 vulnerabilities","description":"USN-5348-1 fixed several vulnerabilities in Smarty. This update provides\nthe fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and\nCVE-2021-29454 for Ubuntu 20.04 ESM.\n\nOriginal advisory details:\n\n David Gnedt and Thomas Konrad discovered that Smarty was incorrectly\n sanitizing the paths present in the templates. An attacker could possibly\n use this use to read arbitrary files when controlling the executed\n template. (CVE-2018-13982)\n\n It was discovered that Smarty was incorrectly sanitizing the paths\n present in the templates. An attacker could possibly use this use to read\n arbitrary files when controlling the executed template. (CVE-2018-16831)\n\n It was discovered that Smarty was incorrectly validating security policy\n data, allowing the execution of static classes even when not permitted by\n the security settings. An attacker could possibly use this issue to\n execute arbitrary code. (CVE-2021-21408)\n\n It was discovered that Smarty was incorrectly managing access control to\n template objects, which allowed users to perform a sandbox escape. An\n attacker could possibly use this issue to send specially crafted input to\n applications that use Smarty and execute arbitrary code. (CVE-2021-26119)\n\n It was discovered that Smarty was not checking for special characters\n when setting function names during plugin compile operations. An attacker\n could possibly use this issue to send specially crafted input to\n applications that use Smarty and execute arbitrary code. (CVE-2021-26120)\n\n It was discovered that Smarty was incorrectly sanitizing characters in\n math strings processed by the math function. An attacker could possibly\n use this issue to send specially crafted input to applications that use\n Smarty and execute arbitrary code. (CVE-2021-29454)\n","status":"published","published":"2022-06-21T15:29:25Z","modified":"2026-02-10T04:42:32Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}