CVE-2024-35226
High
Description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
SeverityHigh
CVSS7.3
Exploit probability—
ProductSmarty/smarty
PublishedMay 28, 2024
First seenMay 28, 2024
Weakness typeCWE-94Code injection
How to fix
Update
- smarty/smarty5.1.1, 4.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| smarty/smartyPackagist | 5.0.0 ≤ v < 5.1.1, 3.0.0 ≤ v < 4.5.3 | 5.1.1, 4.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.