smarty vulnerabilities

3 known vulnerabilities in smarty from Smarty-php. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  smarty: Improper Control of Generation of Code

  CVE-2026-82531Oct 6, 2026Smarty-php

  Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged Sm

• 7.3 High severity

  smarty: Improper Control of Generation of Code

  CVE-2024-35226May 28, 2024Smarty-php

  Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust

• 8.8 High severity

  smarty: Improper Control of Generation of Code

  CVE-2022-29221May 24, 2022Smarty-phpEPSS 4.91%

  Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites th