CVE-2021-29454: Sandbox Escape by math function in smarty
Impact Template authors could run arbitrary PHP code by crafting a malicious math string. If a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.
Patches Please upgrade to 4.0.2 or 3.1.42 or higher.
References See documentation on Math function.
For more information If you have any questions or comments about this advisory please open an issue in the Smarty repo
Other sources
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29454?
CVE-2021-29454 is categorized as a high severity vulnerability due to the ability of attackers to execute arbitrary PHP code.
How do I fix CVE-2021-29454?
To fix CVE-2021-29454, upgrade Smarty to version 4.0.2 or 3.1.42 or later versions mentioned in the advisory.
Who is affected by CVE-2021-29454?
CVE-2021-29454 affects users of Smarty versions prior to 4.0.2 and 3.1.42.
What types of attacks can CVE-2021-29454 facilitate?
CVE-2021-29454 facilitates remote code execution attacks through crafted malicious math strings.
Are there any known exploits for CVE-2021-29454?
There are currently no public exploits specific to CVE-2021-29454, but the vulnerability allows for arbitrary code execution, making it highly dangerous.