Smarty vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-26120 Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.Critical 9.8 · Feb 21, 2021
• CVE-2021-26119 Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.High 7.5 · Feb 21, 2021
• CVE-2018-13982 Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization.High 7.5 · Sep 18, 2018
• CVE-2017-1000480 Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template namCritical 9.8 · Jan 3, 2018
• CVE-2014-8350 Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}scripHigh 7.5 · Nov 3, 2014
• CVE-2010-4727 Smarty before 3.0.0 beta 7 does not properly handle the <?php and ?> tags, which has unspecified impact and remote attack vectors.High 10 · Feb 3, 2011
• CVE-2010-4726 Unspecified vulnerability in the math plugin in Smarty before 3.0.0 RC1 has unknown impact and remote attack vectors.High 10 · Feb 3, 2011
• CVE-2010-4725 Smarty before 3.0.0 RC3 does not properly handle an on value of the asp_tags option in the php.ini file, which has unspecified impact and remote attack vectors.High 10 · Feb 3, 2011
• CVE-2010-4724 Multiple unspecified vulnerabilities in the parser implementation in Smarty before 3.0.0 RC3 have unknown impact and remote attack vectors.High 10 · Feb 3, 2011
• CVE-2010-4723 Smarty before 3.0.0, when security is enabled, does not prevent access to the (1) dynamic and (2) private object members of an assigned object, which has unspecHigh 9.3 · Feb 3, 2011
• CVE-2010-4722 Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors.High 10 · Feb 3, 2011
• CVE-2009-5054 Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restriHigh 7.5 · Feb 3, 2011
• CVE-2009-5053 Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file.High 7.5 · Feb 3, 2011
• CVE-2009-5052 Multiple unspecified vulnerabilities in Smarty before 3.0.0 beta 6 have unknown impact and attack vectors.High 10 · Feb 3, 2011
• CVE-2009-1669 The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell High 10 · May 18, 2009
• CVE-2008-4811 The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arbitrary PHP code via High 7.5 · Oct 31, 2008
• CVE-2008-4810 The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectoHigh 7.5 · Oct 31, 2008
• CVE-2008-1066 The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used by Serendipity (S9Y) and other products, allows attackers to call arbitrary PHP functionsHigh 7.5 · Feb 28, 2008
• CVE-2006-7193 PHP remote file inclusion vulnerability in unit_test/test_cases.php in Smarty 2.6.1 allows remote attackers to execute arbitrary PHP code via a URL in the SMARTHigh 7.5 · Apr 12, 2007
• CVE-2006-7105 PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a URL in the filenameCritical 9.8 · Mar 3, 2007
• CVE-2005-0913 Unknown vulnerability in the regex_replace modifier (modifier.regex_replace.php) in Smarty before 2.6.8 allows attackers to execute arbitrary PHP code.High 7.5 · May 2, 2005