Skip to content
OpenAdvisories
High DSA-5830-1 1 CVE

smarty4 - security update

Published Dec 12, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 12 smarty4 4.3.0-1+deb12u2

Vulnerabilities 1

  • High 7.3
    CVE-2024-35226

    PHP Code Injection by malicious attribute in extends-tag in Smarty

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist