{"id":"CVE-2023-28447","aliases":["DEBIAN-CVE-2023-28447","DLA-3956-1","DSA-5826-1","EUVD-2023-0924","GHSA-7j98-h7fp-4vwj","MGASA-2023-0155","UBUNTU-CVE-2023-28447","USN-6550-1","USN-7158-1","USN-8242-1","USN-8242-2","USN-8272-1"],"status":"published","title":"Cross site scripting vulnerability in Javascript escaping in smarty/smarty","description":"Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01016,"percentile":0.63549,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2023-03-28T20:07:39Z","modified":"2026-10-28T02:30:50Z","exploits":[{"source":"pocgithub","id":"drkbcn/lblfixer_cve_2023_28447","title":"drkbcn/lblfixer_cve_2023_28447","date":"2023-03-30","url":"https://github.com/drkbcn/lblfixer_cve_2023_28447"}],"fixes":[{"ecosystem":"Packagist","package":"smarty/smarty","fixed_in":["4.3.1","3.1.48"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"smarty3","fixed_in":["3.1.47-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty3","fixed_in":["3.1.48-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty3","fixed_in":["3.1.48-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"smarty4","fixed_in":["4.3.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty4","fixed_in":["4.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty4","fixed_in":["4.3.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"php-smarty","fixed_in":["4.3.1-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"civicrm","fixed_in":["4.7.1+dfsg-2ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","fixed_in":["3.1.21-1ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"civicrm","fixed_in":["4.7.30+dfsg-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfixadmin","fixed_in":["3.0.2-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"smarty3","fixed_in":["3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"civicrm","fixed_in":["5.21.2+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postfixadmin","fixed_in":["3.2.1-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","fixed_in":["3.1.39-2ubuntu1.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"civicrm","fixed_in":["5.33.2+dfsg1-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postfixadmin","fixed_in":["3.3.10-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"smarty3","fixed_in":["3.1.48-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"postfixadmin","fixed_in":["3.3.13-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.3.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47-2+deb12u1"}]}],"versions":["3.1.47-2"]},{"source":"osv","ecosystem":"Debian:13","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1+deb12u1"}]}],"versions":["4.3.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2+deb11u2"}]}],"versions":["3.1.39-1","3.1.39-2","3.1.39-2+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47-2+deb12u1"}]}],"versions":["3.1.47-2"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.3.1"}]}],"versions":["v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.1.0","v4.1.1","v4.2.0","v4.2.1","v4.3.0"]},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48"}]}],"versions":["v2.6.24","v2.6.25","v2.6.26","v2.6.27","v2.6.28","v2.6.29","v2.6.30","v2.6.31","v2.6.33","v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.20","v3.1.21","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.30","v3.1.31","v3.1.32","v3.1.33","v3.1.34","v3.1.35","v3.1.36","v3.1.37","v3.1.37.1","v3.1.38","v3.1.39","v3.1.40","v3.1.41","v3.1.42","v3.1.43","v3.1.44","v3.1.45","v3.1.46","v3.1.47"]},{"source":"osv","ecosystem":"Mageia:8","package":"php-smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1+dfsg-2ubuntu1+esm1"}]}],"versions":["4.7.1+dfsg-1","4.7.1+dfsg-2","4.7.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-1ubuntu1+esm2"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1","3.1.21-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.30+dfsg-1ubuntu1+esm1"}]}],"versions":["4.7.23+dfsg-1ubuntu1","4.7.24+dfsg-1ubuntu1","4.7.30+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-2ubuntu0.1~esm1"}]}],"versions":["3.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3","3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.2+dfsg-1ubuntu0.1~esm1"}]}],"versions":["5.11.0+dfsg-1","5.18.1+dfsg-1","5.20.3+dfsg-1","5.21.0+dfsg-1","5.21.1+dfsg-1","5.21.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3ubuntu0.1~esm1"}]}],"versions":["3.2.1-2","3.2.1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2ubuntu1.22.04.2"}]}],"versions":["3.1.39-2","3.1.39-2ubuntu1","3.1.39-2ubuntu1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.33.2+dfsg1-1ubuntu1+esm1"}]}],"versions":["5.33.2+dfsg1-1","5.33.2+dfsg1-1build1","5.33.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.10-2ubuntu0.1~esm1"}]}],"versions":["3.3.7-1","3.3.10-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-1ubuntu0.24.04.1"}]}],"versions":["3.1.48-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-1ubuntu0.1~esm1"}]}],"versions":["3.3.13-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-2ubuntu0.1~esm1"}]}],"versions":["3.0.2-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3ubuntu0.1~esm1"}]}],"versions":["3.2.1-2","3.2.1-3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.10-2ubuntu0.1~esm1"}]}],"versions":["3.3.7-1","3.3.10-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3","3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2ubuntu1.22.04.2"}]}],"versions":["3.1.39-2","3.1.39-2ubuntu1","3.1.39-2ubuntu1.22.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-1ubuntu0.24.04.1"}]}],"versions":["3.1.48-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1+dfsg-2ubuntu1+esm1"}]}],"versions":["4.7.1+dfsg-1","4.7.1+dfsg-2","4.7.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.30+dfsg-1ubuntu1+esm1"}]}],"versions":["4.7.23+dfsg-1ubuntu1","4.7.24+dfsg-1ubuntu1","4.7.30+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.2+dfsg-1ubuntu0.1~esm1"}]}],"versions":["5.11.0+dfsg-1","5.18.1+dfsg-1","5.20.3+dfsg-1","5.21.0+dfsg-1","5.21.1+dfsg-1","5.21.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.33.2+dfsg1-1ubuntu1+esm1"}]}],"versions":["5.33.2+dfsg1-1","5.33.2+dfsg1-1build1","5.33.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"postfixadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-1ubuntu0.1~esm1"}]}],"versions":["3.3.13-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-1ubuntu1+esm2"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1","3.1.21-1ubuntu1+esm1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"smarty","product":"smarty"},{"vendor":"smarty-php","product":"smarty"}],"references":[{"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwj","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/smarty-php/smarty/commit/685662466f653597428966d75a661073104d713d","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHT/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HP/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28447","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2023-28447.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHT","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HP","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7j98-h7fp-4vwj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28447.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28447","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0155.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31794","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ/","tags":["web"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.3.0","tags":["web"]},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.3.1","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-28447","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6550-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28447","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7158-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8242-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8242-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8272-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-29221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-25047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35226","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-28447","title":"Cross site scripting vulnerability in Javascript escaping in smarty/smarty","description":"Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.","status":"published","published":"2023-03-28T20:07:39.103Z","modified":"2025-11-03T21:47:36.097Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-0924","description":"Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.","status":"published","published":"2023-03-28T20:07:39Z","modified":"2025-11-03T21:47:36Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:49:31.25882Z"}],"ghsa":[{"id":"GHSA-7j98-h7fp-4vwj","title":"smarty Cross-site Scripting vulnerability in Javascript escaping ","description":"### Impact\nAn attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user.\n\n### Patches\nPlease upgrade to the most recent version of Smarty v3 or v4.\n\n### For more information\nIf you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)","status":"published","published":"2023-03-29T18:31:35Z","modified":"2025-11-04T16:42:46Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2023-28447","description":"Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.","status":"published","published":"2023-03-28T21:15:11.127Z","modified":"2026-06-17T05:47:45.52Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:51.883939Z"}],"osv":[{"id":"CVE-2023-28447","title":"Cross site scripting vulnerability in Javascript escaping in smarty/smarty","description":"Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.","status":"published","published":"2023-03-28T20:07:39.103Z","modified":"2026-10-28T02:30:50.710485686Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-28447","description":"Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.","status":"published","published":"2023-03-28T21:15:11.127Z","modified":"2026-10-26T18:01:02.986136291Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"GHSA-7j98-h7fp-4vwj","title":"smarty Cross-site Scripting vulnerability in Javascript escaping ","description":"### Impact\nAn attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user.\n\n### Patches\nPlease upgrade to the most recent version of Smarty v3 or v4.\n\n### For more information\nIf you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)","status":"published","published":"2023-03-29T18:31:35Z","modified":"2025-11-04T17:02:03.167355Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2023-28447","description":"Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.","status":"published","published":"2023-03-28T21:15:00Z","modified":"2026-05-20T16:32:35.818532343Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"DLA-3956-1","title":"smarty3 - security update","status":"published","published":"2024-11-17T00:00:00Z","modified":"2026-03-09T01:21:13.388555Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5826-1","title":"smarty3 - security update","status":"published","published":"2024-12-10T00:00:00Z","modified":"2026-03-09T02:10:39.305986Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0155","title":"Updated php-smarty packages fix security vulnerability","description":"Cross site scripting vulnerability in Javascript escaping.\n(CVE-2023-28447)\n\nAdditional bug fixes included. See referenced release notes for details.\n","status":"published","published":"2023-04-24T00:20:26Z","modified":"2026-04-16T04:41:50.951077208Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-6550-1","title":"postfixadmin vulnerabilities","description":"It was discovered that Smarty, that is integrated in the PostfixAdmin\ncode, was not properly sanitizing user input when generating templates. An\nattacker could, through PHP injection, possibly use this issue to execute\narbitrary code. (CVE-2022-29221)\n\nIt was discovered that Moment.js, that is integrated in the PostfixAdmin\ncode, was using an inefficient parsing algorithm when processing date\nstrings in the RFC 2822 standard. An attacker could possibly use this\nissue to cause a denial of service. This issue only affected Ubuntu 22.04\nLTS. (CVE-2022-31129)\n\nIt was discovered that Smarty, that is integrated in the PostfixAdmin\ncode, was not properly escaping JavaScript code. An attacker could\npossibly use this issue to conduct cross-site scripting attacks (XSS).\n(CVE-2023-28447)\n","status":"published","published":"2023-12-12T12:15:17Z","modified":"2026-04-27T17:00:05.456651Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-7158-1","title":"smarty3 vulnerabilities","description":"It was discovered that Smarty incorrectly handled query parameters in\nrequests. An attacker could possibly use this issue to inject arbitrary\nJavascript code, resulting in denial of service or potential execution of\narbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2018-25047, CVE-2023-28447)\n\nIt was discovered that Smarty did not properly sanitize user input when\ngenerating templates. An attacker could, through PHP injection, possibly\nuse this issue to execute arbitrary code. (CVE-2024-35226)\n","status":"published","published":"2024-12-12T21:51:34Z","modified":"2026-04-27T17:36:53.800249Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-8242-1","title":"civicrm vulnerability","description":"Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not\nproperly escape JavaScript code. An attacker could possibly use this issue\nto conduct a cross-site scripting attack.","status":"published","published":"2026-05-07T07:47:07Z","modified":"2026-06-25T13:32:32.13372932Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8242-2","title":"postfixadmin vulnerability","description":"USN-8242-1 fixed a vulnerability in CiviCRM. This update provides the\ncorresponding fix for PostfixAdmin.\n\nOriginal advisory details:\n\nTakuya Aramaki discovered that Smarty, vendored in CiviCRM, did not\nproperly escape JavaScript code. An attacker could possibly use this issue\nto conduct a cross-site scripting attack.","status":"published","published":"2026-05-07T08:00:20Z","modified":"2026-05-20T16:32:34.678614899Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8272-1","title":"smarty3 vulnerability","description":"Takuya Aramaki discovered that Smarty did not properly escape JavaScript\ncode. An attacker could possibly use this issue to conduct a cross-site\nscripting attack.","status":"published","published":"2026-05-19T07:40:32Z","modified":"2026-06-25T13:32:32.152180378Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}