What’s Vulnerable › Products

smarty-php smarty vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your smarty-php smarty version is affected

Latest smarty-php smarty vulnerabilities

• CVE-2026-82531 — Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache (CVSS 8.1)
• CVE-2026-62993 — Smarty: SSRF via redirect bypass of trusted_uri using {fetch} (CVSS 6.9)
• CVE-2026-62996 — Smarty Security stream restriction bypass through stream: resource (CVSS 6.9)
• CVE-2026-62992 — Smarty: Symlink path traversal out of trusted directories (CVSS 6.9)
• CVE-2024-35226 — PHP Code Injection by malicious attribute in extends-tag in Smarty (CVSS 7.3)