CVE-2024-35226

Published: May 28, 2024Modified: Jun 17, 2026Deferred

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.1 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (5)

https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a

Source: security-advisories@github.com

https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w

Source: security-advisories@github.com

https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.