CVE-2026-62992mediumCWE-22CWE-61

CVE-2026-62992: falha de média gravidade em smarty-php smarty

Smarty: Symlink path traversal out of trusted directories

Publicada em

Seguir esta CVE+ Monitorar smarty+ Monitorar smarty3

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.5%
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
smarty-php · smarty
CVEs relacionadas — smarty-php smarty

No mesmo produto, das mais perigosas para as menos.

CVE-2022-29221HIGHPHP Code Injection by malicious block or filename in SmartyEPSS 4.9%CVE-2021-21408HIGHAccess to restricted PHP code by dynamic static class access in smartyEPSS 2.1%CVE-2021-29454HIGHSandbox Escape by math function in smartyEPSS 1.9%CVE-2023-28447HIGHCross site scripting vulnerability in Javascript escaping in smarty/smartyEPSS 1.0%CVE-2026-82531CRITICALSmarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance CacheEPSS 0.8%CVE-2026-62993MEDIUMSmarty: SSRF via redirect bypass of trusted_uri using {fetch}EPSS 0.6%