Skip to content
OpenAdvisories
High DLA-3033-1 1 CVE

smarty3 - security update

Published May 29, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 smarty3 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u6

Vulnerabilities 1

  • High 8.8
    CVE-2022-29221 Public exploit

    PHP Code Injection by malicious block or filename in Smarty

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites t…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist