CVE-2022-29221: PHP Code Injection by malicious block or filename in Smarty
Last updated 24 July 2024
Other sources
PHP Code Injection by malicious block or filename
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29221?
CVE-2022-29221 is considered a high severity vulnerability due to its potential for PHP code injection which can lead to arbitrary code execution.
How do I fix CVE-2022-29221?
To fix CVE-2022-29221, update Smarty to version 3.1.45 or 4.1.1 or later.
Which versions of Smarty are affected by CVE-2022-29221?
CVE-2022-29221 affects Smarty versions prior to 3.1.45 and between 4.0.0 and 4.1.1.
What types of attacks can CVE-2022-29221 facilitate?
CVE-2022-29221 can facilitate PHP code injection attacks, allowing attackers to execute arbitrary PHP code on the server.
Is CVE-2022-29221 related to any specific software distributions?
Yes, CVE-2022-29221 impacts several distributions including Debian and Fedora, particularly certain versions of Smarty.