Skip to content
OpenAdvisories
Medium DLA-3262-1 1 CVE

smarty3 - security update

Published Jan 5, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 smarty3 3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u2

Vulnerabilities 1

  • Medium 5.4
    CVE-2018-25047

    Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto

    In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.

    smarty3 smarty/smarty smarty3 smarty4 Debian Ubuntu Packagist