CVE-2024-35226 — Code Injection in Smarty

CWE-94 — Code Injection6 documents4 sources
Severity
7.3HIGHCNA
OSV5.4
No vector
EPSS
0.2%
top 63.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SmartySmarty-php Smarty
Timeline
PublishedMay 28
Latest updateMar 27

Description

PHP Code Injection by malicious attribute in extends-tag in Smarty Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.

Affected Packages2 packages

▶Packagistsmarty/smarty5.0.0 — 5.1.1+1
▶CVEListV5smarty-php/smarty>= 3.0.0, < 4.5.3, >= 5.0.0, < 5.1.1+1

🔴Vulnerability Details

4
OSV
smarty3 vulnerabilities↗2024-12-12
▶
GHSA
Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag↗2024-05-29
▶
OSV
Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag↗2024-05-29
▶
CVEList
PHP Code Injection by malicious attribute in extends-tag in Smarty↗2024-05-28
▶

📋Vendor Advisories

2
Ubuntu
Smarty vulnerability↗2025-03-27
▶
Ubuntu
Smarty vulnerabilities↗2024-12-12
▶