CVE-2026-62992mediumCWE-22CWE-61

CVE-2026-62992: fallo de gravedad media en smarty-php smarty

Smarty: Symlink path traversal out of trusted directories

Publicada el

Seguir esta CVE+ Monitorear smarty+ Monitorear smarty3

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.5%
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
smarty-php · smarty
CVEs relacionadas — smarty-php smarty

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-29221HIGHPHP Code Injection by malicious block or filename in SmartyEPSS 4.9%CVE-2021-21408HIGHAccess to restricted PHP code by dynamic static class access in smartyEPSS 2.1%CVE-2021-29454HIGHSandbox Escape by math function in smartyEPSS 1.9%CVE-2023-28447HIGHCross site scripting vulnerability in Javascript escaping in smarty/smartyEPSS 1.0%CVE-2026-82531CRITICALSmarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance CacheEPSS 0.8%CVE-2026-62993MEDIUMSmarty: SSRF via redirect bypass of trusted_uri using {fetch}EPSS 0.6%