Skip to content
OpenAdvisories
High USN-6012-1 1 CVE

smarty3 vulnerability

Published Apr 13, 2023 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Smarty incorrectly parsed blocks' names and
included files' names. A remote attacker with template writing permissions
could use this issue to execute arbitrary PHP code. (CVE-2022-29221)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS smarty3 3.1.39-2ubuntu1.22.04.1

Vulnerabilities 1

  • High 8.8
    CVE-2022-29221 Public exploit

    PHP Code Injection by malicious block or filename in Smarty

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites t…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2022-29221