smarty-php smarty vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20231
3. 20241
4. 20264

Newest CVEs

• CVE-2026-82531

  Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

  smarty-php · smarty

  Critical9.2
• CVE-2026-62993

  Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

  smarty-php · smarty

  Medium6.9
• CVE-2026-62996

  Smarty Security stream restriction bypass through stream: resource

  smarty-php · smarty

  Medium6.9
• CVE-2026-62992

  Smarty: Symlink path traversal out of trusted directories

  smarty-php · smarty

  Medium6.9
• CVE-2024-35226

  PHP Code Injection by malicious attribute in extends-tag in Smarty

  smarty-php · smarty

  High7.3
• CVE-2023-28447

  Cross site scripting vulnerability in Javascript escaping in smarty/smarty

  smarty-php · smarty

  High7.1
• CVE-2022-29221

  PHP Code Injection by malicious block or filename in Smarty

  smarty-php · smarty

  High8.8
• CVE-2021-29454

  Sandbox Escape by math function in smarty

  smarty-php · smarty

  High8.1
• CVE-2021-21408

  Access to restricted PHP code by dynamic static class access in smarty

  smarty-php · smarty

  High8.8