GitHub Advisoryadvisory · Packagist
GHSA-4rmg-292m-wg3w Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag
HIGH
Official page ↗
- Aliases
- CVE-2024-35226
- Ecosystem
- Packagist
- Packages
- smarty/smarty
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-94
- Reviewed
- 2024-05-29
Affected packages
• Packagist smarty/smarty: >= 5.0.0, < 5.1.1 → fixed in 5.1.1
• Packagist smarty/smarty: >= 3.0.0, < 4.5.3 → fixed in 4.5.3
Description
Impact
Template authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.
Patches
Please upgrade to the most recent version of Smarty v4 or v5. There is no patch for v3.
Related
Alias · CVE (1)
- CVE-2024-35226 Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w web
- https://nvd.nist.gov/vuln/detail/CVE-2024-35226 advisory
- https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a web
- https://github.com/smarty-php/smarty package
- https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html web