Skip to content
OpenAdvisories
High DLA-3956-1 3 CVEs

smarty3 - security update

Published Nov 17, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 smarty3 3.1.39-2+deb11u2

Vulnerabilities 3

  • High 7.3
    CVE-2024-35226

    PHP Code Injection by malicious attribute in extends-tag in Smarty

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist
  • High 7.1
    CVE-2023-28447 Public exploit

    Cross site scripting vulnerability in Javascript escaping in smarty/smarty

    Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthor…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist
  • Medium 5.4
    CVE-2018-25047

    Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto

    In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.

    smarty3 smarty/smarty smarty3 smarty4 Debian Ubuntu Packagist