{"id":"CVE-2022-29221","aliases":["DEBIAN-CVE-2022-29221","DLA-3033-1","DSA-5151-1","EUVD-2022-2696","GHSA-634x-pc3q-cf4c","MGASA-2022-0226","UBUNTU-CVE-2022-29221","USN-6012-1","USN-6550-1"],"status":"published","title":"PHP Code Injection by malicious block or filename in Smarty","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.04914,"percentile":0.92184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2022-05-24T00:00:00Z","modified":"2026-11-03T08:03:52Z","exploits":[{"source":"pocgithub","id":"sbani/CVE-2022-29221-PoC","title":"sbani/CVE-2022-29221-PoC","date":"2022-05-25","url":"https://github.com/sbani/CVE-2022-29221-PoC"}],"fixes":[{"ecosystem":"Packagist","package":"smarty/smarty","fixed_in":["3.1.45","4.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"smarty3","fixed_in":["3.1.45-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty3","fixed_in":["3.1.45-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty3","fixed_in":["3.1.45-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"smarty4","fixed_in":["4.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty4","fixed_in":["4.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty4","fixed_in":["4.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u6"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"php-smarty","fixed_in":["4.1.1-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfixadmin","fixed_in":["3.0.2-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postfixadmin","fixed_in":["3.2.1-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","fixed_in":["3.1.39-2ubuntu1.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postfixadmin","fixed_in":["3.3.10-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u6"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u1","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u2","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u3","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u4","3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u5"]},{"source":"osv","ecosystem":"Debian:10","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2+deb11u1"}]}],"versions":["3.1.39-1","3.1.39-2"],"bundled":3},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45"}]}],"versions":["v2.6.24","v2.6.25","v2.6.26","v2.6.27","v2.6.28","v2.6.29","v2.6.30","v2.6.31","v2.6.33","v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.20","v3.1.21","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.30","v3.1.31","v3.1.32","v3.1.33","v3.1.34","v3.1.35","v3.1.36","v3.1.37","v3.1.37.1","v3.1.38","v3.1.39","v3.1.40","v3.1.41","v3.1.42","v3.1.43","v3.1.44"]},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.1"}]}],"versions":["v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.1.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"collabtive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0+dfsg-6","2.0+dfsg-6ubuntu1","2.0+dfsg-6ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"galette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8+dfsg-1","0.8+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.4+reloaded2-2","2.7.4+reloaded2-5","2.7.4+reloaded2-6","2.7.4+reloaded2-7","2.7.4+reloaded2-8","2.7.4+reloaded2-9","2.7.4+reloaded2-9ubuntu1","2.7.4+reloaded2-9ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1","3.1.21-1ubuntu1+esm1","3.1.21-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.4+reloaded2-13ubuntu1","2.7.4+reloaded3-2ubuntu1","2.7.4+reloaded3-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-2ubuntu0.1~esm1"}]}],"versions":["3.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3","3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1","3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.4+reloaded3-10","2.7.4+reloaded3-10ubuntu1","2.7.4+reloaded3-11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3ubuntu0.1~esm1"}]}],"versions":["3.2.1-2","3.2.1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1","3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1","3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.4+reloaded3-16build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2ubuntu1.22.04.1"}]}],"versions":["3.1.39-2","3.1.39-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.10-2ubuntu0.1~esm1"}]}],"versions":["3.3.7-1","3.3.10-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8~git20230203.10abe45+dfsg-8","2.8~git20230203.10abe45+dfsg-9","2.8~git20230203.10abe45+dfsg-10","2.8~git20230203.10abe45+dfsg-11"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8~git20230203.10abe45+dfsg-18","2.8~git20230203.10abe45+dfsg-19"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8~git20230203.10abe45+dfsg-19"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gosa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8~git20230203.10abe45+dfsg-19"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2ubuntu1.22.04.1"}]}],"versions":["3.1.39-2","3.1.39-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-2ubuntu0.1~esm1"}]}],"versions":["3.0.2-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3ubuntu0.1~esm1"}]}],"versions":["3.2.1-2","3.2.1-3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.10-2ubuntu0.1~esm1"}]}],"versions":["3.3.7-1","3.3.10-2"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"smarty","product":"smarty"},{"vendor":"smarty-php","product":"smarty"}],"references":[{"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v3.1.45","tags":["x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.1.1","tags":["x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00044.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://www.debian.org/security/2022/dsa-5151","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202209-09","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29221","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2022-29221.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/"},{"url":"https://github.com/advisories/GHSA-634x-pc3q-cf4c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29221.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-29221","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0226.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29221","tags":["report"]},{"url":"https://github.com/smarty-php/smarty/commit/3606c4717ed6348e114a610ff1e446048dcd0345","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6012-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6550-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-28447","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-29221","title":"PHP Code Injection by malicious block or filename in Smarty","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.","status":"published","published":"2022-05-24T00:00:00Z","modified":"2025-04-23T18:22:54.999Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:36.270817Z"}],"euvd":[{"id":"EUVD-2022-2696","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.","status":"published","published":"2022-05-24T00:00:00Z","modified":"2025-04-23T18:22:54Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:08.95736Z"}],"ghsa":[{"id":"GHSA-634x-pc3q-cf4c","title":"PHP Code Injection by malicious block or filename in Smarty","description":"### Impact\nTemplate authors could inject php code by choosing a malicous {block} name or {include} file name. Sites that cannot fully trust template authors should update asap.\n\n### Patches\nPlease upgrade to the most recent version of Smarty v3 or v4.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n_Are there any links users can visit to find out more?_\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)\n","status":"published","published":"2022-05-25T20:15:02Z","modified":"2023-01-27T05:02:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2022-29221","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.","status":"published","published":"2022-05-24T15:15:07.917Z","modified":"2026-06-17T04:39:51.637Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:21.261605Z"}],"osv":[{"id":"CVE-2022-29221","title":"PHP Code Injection by malicious block or filename in Smarty","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.","status":"published","published":"2022-05-24T00:00:00Z","modified":"2026-10-28T02:30:40.71771075Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"DEBIAN-CVE-2022-29221","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.","status":"published","published":"2022-05-24T15:15:07.917Z","modified":"2026-11-03T08:03:52.214521107Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"GHSA-634x-pc3q-cf4c","title":"PHP Code Injection by malicious block or filename in Smarty","description":"### Impact\nTemplate authors could inject php code by choosing a malicous {block} name or {include} file name. Sites that cannot fully trust template authors should update asap.\n\n### Patches\nPlease upgrade to the most recent version of Smarty v3 or v4.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n_Are there any links users can visit to find out more?_\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)\n","status":"published","published":"2022-05-25T20:15:02Z","modified":"2024-02-21T05:31:14.008596Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"UBUNTU-CVE-2022-29221","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.","status":"published","published":"2022-05-24T15:15:00Z","modified":"2026-10-17T12:55:58.277164021Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"DLA-3033-1","title":"smarty3 - security update","status":"published","published":"2022-05-29T00:00:00Z","modified":"2026-03-09T01:22:54.984176Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5151-1","title":"smarty3 - security update","status":"published","published":"2022-05-29T00:00:00Z","modified":"2026-03-09T02:10:08.2205Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0226","title":"Updated php-smarty packages fix security vulnerability","description":"Template authors could inject php code by choosing a malicious {block}\nname or {include} file name. (CVE-2022-29221)\n","status":"published","published":"2022-06-13T20:44:20Z","modified":"2026-04-16T04:44:03.80788772Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"USN-6012-1","title":"smarty3 vulnerability","description":"It was discovered that Smarty incorrectly parsed blocks' names and\nincluded files' names. A remote attacker with template writing permissions\ncould use this issue to execute arbitrary PHP code. (CVE-2022-29221)\n","status":"published","published":"2023-04-13T07:16:07Z","modified":"2026-04-27T16:39:04.099494Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-6550-1","title":"postfixadmin vulnerabilities","description":"It was discovered that Smarty, that is integrated in the PostfixAdmin\ncode, was not properly sanitizing user input when generating templates. An\nattacker could, through PHP injection, possibly use this issue to execute\narbitrary code. (CVE-2022-29221)\n\nIt was discovered that Moment.js, that is integrated in the PostfixAdmin\ncode, was using an inefficient parsing algorithm when processing date\nstrings in the RFC 2822 standard. An attacker could possibly use this\nissue to cause a denial of service. This issue only affected Ubuntu 22.04\nLTS. (CVE-2022-31129)\n\nIt was discovered that Smarty, that is integrated in the PostfixAdmin\ncode, was not properly escaping JavaScript code. An attacker could\npossibly use this issue to conduct cross-site scripting attacks (XSS).\n(CVE-2023-28447)\n","status":"published","published":"2023-12-12T12:15:17Z","modified":"2026-04-27T17:00:05.456651Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}