CVE-2009-5054

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-02-03 · updated 2026-06-16
Weakness: CWE-264

Description

Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.

Affected products

Smarty: through 2.6.26; 1.0, 1.0a, 1.0b, 1.1.0, 1.2.0, 1.2.1 (+54)

References

http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt
http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt

Get alerted when CVE-2009-5054 or the next vulnerability affects your stack