CVE-2026-62993: Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri() to validate only the initial remote URL against trusteduri when a security policy was active. For resources handled by filegetcontents(), including HTTPS URLs, PHP followed HTTP redirects by default. An attacker who could supply or influence a fetch target and had an open redirect on a trusted host could redirect the request to an attacker-chosen internal endpoint, bypass the trusteduri allowlist, and perform server-side request forgery. This issue is fixed in versions 4.5.7 and 5.8.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Smartyto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
Smartyto a version that resolves this vulnerability.Fixed in 5.8.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Smarty before 4.5.7 or 5.8.2 are exposed if a security policy is active, {fetch} can be supplied or influenced by an attacker, and a trusted_uri-allowlisted host has an open redirect.
What does an attacker need to exploit the bypass?
The attacker needs to control or influence the URL passed to {fetch} and use an open redirect on a host permitted by trusted_uri. The redirect can then send the server-side request to an attacker-chosen internal endpoint.
Are HTTPS fetch targets affected?
Yes. Resources handled through file_get_contents(), including HTTPS URLs, can be affected because PHP follows HTTP redirects by default.
How can this be remediated?
Upgrade Smarty to version 4.5.7 on the 4.x release line or 5.8.2 on the 5.x release line.