CVE-2024-35226: Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag
Impact Template authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.
Patches Please upgrade to the most recent version of Smarty v4 or v5. There is no patch for v3.
Other sources
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
— Launchpad
Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/smarty/smartyto a version that resolves this vulnerability.Fixed in 4.5.3 - Upgrade
Upgrade
composer/smarty/smartyto a version that resolves this vulnerability.Fixed in 5.1.1 - Upgrade
Upgrade
debian/smarty3to a version that resolves this vulnerability.Fixed in 3.1.47-2+deb12u1 - Upgrade
Upgrade
debian/smarty3to a version that resolves this vulnerability.Fixed in 3.1.48-2 - Upgrade
Upgrade
debian/smarty4to a version that resolves this vulnerability.Fixed in 4.3.0-1+deb12u2 - Upgrade
Upgrade
debian/smarty4to a version that resolves this vulnerability.Fixed in 4.5.4-1 - Upgrade
Upgrade
debian/smarty3to a version that resolves this vulnerability.Fixed in 3.1.47-2+deb12u1Fixed in 3.1.48-2 - Upgrade
Upgrade
debian/smarty4to a version that resolves this vulnerability.Fixed in 4.3.0-1+deb12u2Fixed in 4.5.5-1Fixed in 4.5.8-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35226?
CVE-2024-35226 has a critical severity due to the potential for PHP code injection by untrusted template authors.
How do I fix CVE-2024-35226?
To fix CVE-2024-35226, upgrade to the latest version of Smarty, specifically version 4.5.3 or 5.1.1, as there is no patch for v3.
What are the affected versions of Smarty for CVE-2024-35226?
Affected versions of Smarty include versions 3.0.0 to 4.5.2 and 5.0.0 to 5.1.0.
What happens if I do not remediate CVE-2024-35226?
Failing to remediate CVE-2024-35226 may lead to unauthorized PHP code execution, compromising the security of your applications.
Which platforms or packages are impacted by CVE-2024-35226?
CVE-2024-35226 impacts the Smarty PHP template engine, particularly versions provided through Composer and Debian packages.