{"id":"CVE-2024-35226","aliases":["DEBIAN-CVE-2024-35226","DLA-3956-1","DSA-5826-1","DSA-5830-1","EUVD-2024-1424","GHSA-4rmg-292m-wg3w","UBUNTU-CVE-2024-35226","USN-7158-1","USN-7377-1"],"status":"published","title":"PHP Code Injection by malicious attribute in extends-tag in Smarty","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00507,"percentile":0.43761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2024-05-28T20:55:00Z","modified":"2026-11-02T12:02:32Z","fixes":[{"ecosystem":"Packagist","package":"smarty/smarty","fixed_in":["5.1.1","4.5.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"smarty3","fixed_in":["3.1.47-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty3","fixed_in":["3.1.48-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty3","fixed_in":["3.1.48-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"smarty4","fixed_in":["4.3.0-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"smarty4","fixed_in":["4.5.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"smarty4","fixed_in":["4.5.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","fixed_in":["3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"smarty3","fixed_in":["3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","fixed_in":["3.1.39-2ubuntu1.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"smarty3","fixed_in":["3.1.48-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"smarty4","fixed_in":["4.3.1-1ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"4.5.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47-2+deb12u1"}]}],"versions":["3.1.47-2"]},{"source":"osv","ecosystem":"Debian:13","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1+deb12u2"}]}],"versions":["4.3.0-1","4.3.0-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.4-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2+deb11u2"}]}],"versions":["3.1.39-1","3.1.39-2","3.1.39-2+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.47-2+deb12u1"}]}],"versions":["3.1.47-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1+deb12u2"}]}],"versions":["4.3.0-1","4.3.0-1+deb12u1"]},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.1"}]}],"versions":["v5.0.0","v5.0.1","v5.0.2","v5.1.0"]},{"source":"osv","ecosystem":"Packagist","package":"smarty/smarty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"4.5.3"}]}],"versions":["v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.20","v3.1.21","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.30","v3.1.31","v3.1.32","v3.1.33","v3.1.34","v3.1.35","v3.1.36","v3.1.37","v3.1.37.1","v3.1.38","v3.1.39","v3.1.40","v3.1.41","v3.1.42","v3.1.43","v3.1.44","v3.1.45","v3.1.46","v3.1.47","v3.1.48","v4.0.0","v4.0.0-rc.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.1.0","v4.1.1","v4.2.0","v4.2.1","v4.3.0","v4.3.1","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.4.0","v4.4.1","v4.5.0","v4.5.1","v4.5.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.21-1","3.1.21-1ubuntu1","3.1.21-1ubuntu1+esm1","3.1.21-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3","3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2ubuntu1.22.04.2"}]}],"versions":["3.1.39-2","3.1.39-2ubuntu1","3.1.39-2ubuntu1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-1ubuntu0.24.04.1"}]}],"versions":["3.1.48-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1ubuntu0.24.04.1"}]}],"versions":["4.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.48-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.48-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.48-2","3.1.48-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3","3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1"}]}],"versions":["3.1.33+20180830.1.3a78a21f+selfpack1-1","3.1.34+20190228.1.c9f0de05+selfpack1-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.39-2ubuntu1.22.04.2"}]}],"versions":["3.1.39-2","3.1.39-2ubuntu1","3.1.39-2ubuntu1.22.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"smarty3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.48-1ubuntu0.24.04.1"}]}],"versions":["3.1.48-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"smarty4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1ubuntu0.24.04.1"}]}],"versions":["4.3.1-1"]}],"products":[{"vendor":"smarty-php","product":"smarty"}],"references":[{"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w","tags":["x_refsource_CONFIRM","x_transferred","advisory","web","report"]},{"url":"https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a","tags":["x_refsource_MISC","x_transferred","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35226","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4rmg-292m-wg3w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35226.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-35226","tags":["advisory"]},{"url":"https://github.com/smarty-php/smarty","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-35226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-35226","tags":["report"]},{"url":"https://github.com/smarty-php/smarty/commit/76881c8d33d80648f70c9b0339f770f5f69a87a2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7158-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7377-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-25047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-28447","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-35226","title":"PHP Code Injection by malicious attribute in extends-tag in Smarty","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-28T20:55:00.884Z","modified":"2025-11-03T21:54:58.981Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2024-1424","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-28T20:55:00Z","modified":"2025-11-03T21:54:58Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:30.274226Z"}],"ghsa":[{"id":"GHSA-4rmg-292m-wg3w","title":"Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag","description":"### Impact\nTemplate authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.\n\n### Patches\nPlease upgrade to the most recent version of Smarty v4 or v5. There is no patch for v3.","status":"published","published":"2024-05-29T18:44:30Z","modified":"2025-11-04T16:50:40Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-35226","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-28T21:16:30.947Z","modified":"2026-06-17T07:34:34.84Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:02.520903Z"}],"osv":[{"id":"CVE-2024-35226","title":"PHP Code Injection by malicious attribute in extends-tag in Smarty","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-28T20:55:00.884Z","modified":"2026-10-28T02:30:33.361382644Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"DEBIAN-CVE-2024-35226","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-28T21:16:30.947Z","modified":"2026-11-02T12:02:32.655572347Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-4rmg-292m-wg3w","title":"Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag","description":"### Impact\nTemplate authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.\n\n### Patches\nPlease upgrade to the most recent version of Smarty v4 or v5. There is no patch for v3.","status":"published","published":"2024-05-29T18:44:30Z","modified":"2025-11-04T17:06:06.964777Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"UBUNTU-CVE-2024-35226","description":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-28T21:16:00Z","modified":"2026-10-17T12:56:45.101587894Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"DLA-3956-1","title":"smarty3 - security update","status":"published","published":"2024-11-17T00:00:00Z","modified":"2026-03-09T01:21:13.388555Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5826-1","title":"smarty3 - security update","status":"published","published":"2024-12-10T00:00:00Z","modified":"2026-03-09T02:10:39.305986Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"DSA-5830-1","title":"smarty4 - security update","status":"published","published":"2024-12-12T00:00:00Z","modified":"2026-03-09T02:09:53.960583Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-7158-1","title":"smarty3 vulnerabilities","description":"It was discovered that Smarty incorrectly handled query parameters in\nrequests. An attacker could possibly use this issue to inject arbitrary\nJavascript code, resulting in denial of service or potential execution of\narbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2018-25047, CVE-2023-28447)\n\nIt was discovered that Smarty did not properly sanitize user input when\ngenerating templates. An attacker could, through PHP injection, possibly\nuse this issue to execute arbitrary code. (CVE-2024-35226)\n","status":"published","published":"2024-12-12T21:51:34Z","modified":"2026-04-27T17:36:53.800249Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7377-1","title":"smarty vulnerability","description":"It was discovered that Smarty did not properly sanitize template file\nnames. An attacker could possibly use this issue to cause Smarty to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2025-03-27T18:53:10Z","modified":"2026-04-27T17:49:59.330734Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}