CVE-2026-62992: Smarty: Symlink path traversal out of trusted directories
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.
Other sources
When Smarty's Security policy is enabled, securedir (and the configured template/trusted directories) restrict which local files a template may read via {include} and {fetch}. The trust check in Security::checkDir() resolved the requested path with Smarty::realpath(), which normalizes the path as a string only and does not follow symbolic links. A symlink placed inside a trusted directory therefore passed the trust check, while the underlying filegetcontents() followed it to an arbitrary file outside the sandbox (e.g. /etc/passwd).
Impact An attacker able to (a) cause a symlink to exist inside a trusted directory (e.g. a user-upload area located within the template path) and (b) cause a template to reference that path can read arbitrary files readable by the PHP process, escaping the securedir boundary. Confidentiality impact only.
Patches Fixed in 5.8.2. Security::checkDir() now resolves the requested file with native realpath() and re-validates the canonical, symlink-free path against the trusted directories (which are canonicalized the same way, so legitimate symlinked deployment paths such as a Capistrano current symlink or macOS /var → /private/var keep working). It falls back to string normalization only when the file does not yet exist on disk.
Workarounds Ensure no untrusted symlinks can be created within any directory listed in securedir/the trusted template directories; restrict write access to those directories to trusted processes only.
References - Fix commit: 99c048c - CWE-22
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/smarty/smartyto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
composer/smarty/smartyto a version that resolves this vulnerability.Fixed in 5.8.2 - Upgrade
Upgrade
Smartyto a version that resolves this vulnerability.Fixed in 5.8.2 - Upgrade
Upgrade
Smartyto a version that resolves this vulnerability.Fixed in 4.5.7 - Configuration
Ensure Smarty Security::_checkDir() resolves requested paths using native realpath() and re-validates the canonical, symlink-free path against the configured secure_dir and trusted template directories (so symlinks cannot bypass containment checks).
Smarty Security::_checkDir() symbolic link resolution during secure_dir boundary validation = realpath() based canonical, symlink-free path validation - Compensating control
Ensure no untrusted symlinks can be created within any directory listed in secure_dir / the trusted template directories; restrict write access to those directories to trusted processes only.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62992?
CVE-2026-62992 has a risk score of 33.
How do I fix CVE-2026-62992?
To fix CVE-2026-62992, ensure the Smarty Security policy is properly configured and that secure_dir is effectively restricting access.
What software is affected by CVE-2026-62992?
CVE-2026-62992 affects the composer/smarty/smarty software.
What type of vulnerability is CVE-2026-62992?
CVE-2026-62992 is categorized as a Path Traversal vulnerability.
When was CVE-2026-62992 published?
CVE-2026-62992 was published on August 7, 2026.