CVE-2021-26120: Code Injection

Published Jan 24, 2021
·
Updated

Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.

Other sources

SmartyInternalRuntimeTplFunction Sandbox Escape PHP Code Injection

Template authors could inject php code by choosing a malicous {function} name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher.

GitHub

Affected Software

7 affected componentsFixes available
composer/smarty/smarty<=3.1.38
debian/smarty3
3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u13.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u23.1.39-2+deb11u13.1.47-23.1.48-1
composer/smarty/smarty<3.1.39
3.1.39
Smarty smarty<3.1.39
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0

Event History

Jan 24, 2021
Advisory Published
10:44 PM
Feb 22, 2021
CVE Published
via MITRE·01:38 AM
Data Sourced
via MITRE·01:38 AM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-26120?

CVE-2021-26120 has a medium severity rating due to its potential for code injection via malicious function names in Smarty templates.

2

How do I fix CVE-2021-26120?

To fix CVE-2021-26120, upgrade Smarty to version 3.1.39 or later.

3

What causes CVE-2021-26120?

CVE-2021-26120 is caused by an insufficiently validated function name in Smarty templates that allows for code injection.

4

Which versions of Smarty are affected by CVE-2021-26120?

Smarty versions prior to 3.1.39 are affected by CVE-2021-26120.

5

Is there a way to mitigate CVE-2021-26120 without upgrading?

Mitigating CVE-2021-26120 without upgrading is challenging; it is recommended to implement strict validation of user inputs in templates.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203