CVE-2021-26120: Code Injection
Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.
Other sources
SmartyInternalRuntimeTplFunction Sandbox Escape PHP Code Injection
Template authors could inject php code by choosing a malicous {function} name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-26120?
CVE-2021-26120 has a medium severity rating due to its potential for code injection via malicious function names in Smarty templates.
How do I fix CVE-2021-26120?
To fix CVE-2021-26120, upgrade Smarty to version 3.1.39 or later.
What causes CVE-2021-26120?
CVE-2021-26120 is caused by an insufficiently validated function name in Smarty templates that allows for code injection.
Which versions of Smarty are affected by CVE-2021-26120?
Smarty versions prior to 3.1.39 are affected by CVE-2021-26120.
Is there a way to mitigate CVE-2021-26120 without upgrading?
Mitigating CVE-2021-26120 without upgrading is challenging; it is recommended to implement strict validation of user inputs in templates.