Skip to content
OpenAdvisories
High DLA-2995-1 2 CVEs

smarty3 - security update

Published May 5, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 smarty3 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u5

Vulnerabilities 2

  • High 8.8
    CVE-2021-21408

    Access to restricted PHP code by dynamic static class access in smarty

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 t…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist
  • High 8.1
    CVE-2021-29454

    Sandbox Escape by math function in smarty

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was pas…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist