MGASA-2026-0585: Updated php-smarty package fixes a security vulnerability

Q: What must an attacker be able to control to exploit this issue?

The attacker must be able to supply assigned template data containing a forged SmartyNocache marker. Exploitation also involves templates using extends: or multi-component template inheritance, so that the malformed marker is copied into a regenerated PHP cache file.

Q: What happens after malicious data is injected into the cache file?

The forged content is copied verbatim into the regenerated PHP cache file. When that cache file is included, the injected PHP executes, resulting in remote code execution.

Q: Which Smarty versions are affected?

Smarty versions before 4.5.8 are affected, as are 5.x versions before 5.8.5.

Published Nov 9, 2026

Updated

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Affected Software

1 affected componentFixes available

mageia/php-smarty<5.8.5-1.mga10

5.8.5-1.mga10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mageia/php-smarty to a version that resolves this vulnerability.
Fixed in 5.8.5-1.mga10
Upgrade
Upgrade php-smarty to a version that resolves this vulnerability.
Fixed in 4.5.8
Upgrade
Upgrade php-smarty to a version that resolves this vulnerability.
Fixed in 5.8.5

Event History

Nov 9, 2026

Advisory Published

via OSV·04:32 PM

Data Sourced

via OSV·04:32 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-82531

Frequently Asked Questions

What must an attacker be able to control to exploit this issue?

The attacker must be able to supply assigned template data containing a forged SmartyNocache marker. Exploitation also involves templates using extends: or multi-component template inheritance, so that the malformed marker is copied into a regenerated PHP cache file.

What happens after malicious data is injected into the cache file?

The forged content is copied verbatim into the regenerated PHP cache file. When that cache file is included, the injected PHP executes, resulting in remote code execution.

Which Smarty versions are affected?

Smarty versions before 4.5.8 are affected, as are 5.x versions before 5.8.5.

MGASA-2026-0585: Updated php-smarty package fixes a security vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker be able to control to exploit this issue?

What happens after malicious data is injected into the cache file?

Which Smarty versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to control to exploit this issue?

What happens after malicious data is injected into the cache file?

Which Smarty versions are affected?