Smarty-php vulnerabilities

Products

• Smarty 9

Newest

• smarty-php smarty Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache CVE-2026-82531 Public exploit 9.2 CriticalOctober 6, 2026
• smarty-php smarty Smarty: SSRF via redirect bypass of trusted_uri using {fetch} CVE-2026-62993 Fix available 6.9 MediumAugust 31, 2026
• smarty-php smarty Smarty Security stream restriction bypass through stream: resource CVE-2026-62996 Fix available 6.9 MediumAugust 7, 2026
• smarty-php smarty Smarty: Symlink path traversal out of trusted directories CVE-2026-62992 Fix available 6.9 MediumAugust 7, 2026
• smarty-php smarty PHP Code Injection by malicious attribute in extends-tag in Smarty CVE-2024-35226 Fix available 7.3 HighMay 28, 2024
• smarty, fedoraproject fedora +1 more Cross site scripting vulnerability in Javascript escaping in smarty/smarty CVE-2023-28447 Public exploitFix available 7.1 HighMarch 28, 2023
• smarty, debian linux, fedoraproject fedora +2 more PHP Code Injection by malicious block or filename in Smarty CVE-2022-29221 Public exploitFix available 8.8 HighMay 24, 2022
• smarty, debian linux, fedoraproject fedora +2 more Sandbox Escape by math function in smarty CVE-2021-29454 Fix available 8.1 HighJanuary 10, 2022
• smarty, debian linux, fedoraproject fedora +2 more Access to restricted PHP code by dynamic static class access in smarty CVE-2021-21408 Fix available 8.8 HighJanuary 10, 2022