CVE-2021-26120: Smarty_Internal_Runtime_TplFunction Sandbox Escape PHP Code Injection
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.
Other sources
SmartyInternalRuntimeTplFunction Sandbox Escape PHP Code Injection
Template authors could inject php code by choosing a malicous {function} name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/smarty3to a version that resolves this vulnerability.Fixed in 3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u1Fixed in 3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u2Fixed in 3.1.39-2+deb11u1Fixed in 3.1.47-2Fixed in 3.1.48-1 - Upgrade
Upgrade
composer/smarty/smartyto a version that resolves this vulnerability.Fixed in 3.1.39 - Upgrade
Upgrade
Smartyto a version that resolves this vulnerability.Fixed in 3.1.39
Event History
Frequently Asked Questions
What is the severity of CVE-2021-26120?
CVE-2021-26120 has a medium severity rating due to its potential for code injection via malicious function names in Smarty templates.
How do I fix CVE-2021-26120?
To fix CVE-2021-26120, upgrade Smarty to version 3.1.39 or later.
What causes CVE-2021-26120?
CVE-2021-26120 is caused by an insufficiently validated function name in Smarty templates that allows for code injection.
Which versions of Smarty are affected by CVE-2021-26120?
Smarty versions prior to 3.1.39 are affected by CVE-2021-26120.
Is there a way to mitigate CVE-2021-26120 without upgrading?
Mitigating CVE-2021-26120 without upgrading is challenging; it is recommended to implement strict validation of user inputs in templates.