Skip to content
OpenAdvisories
High USN-7158-1 3 CVEs

smarty3 vulnerabilities

Published Dec 12, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Smarty incorrectly handled query parameters in
requests. An attacker could possibly use this issue to inject arbitrary
Javascript code, resulting in denial of service or potential execution of
arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2018-25047, CVE-2023-28447)

It was discovered that Smarty did not properly sanitize user input when
generating templates. An attacker could, through PHP injection, possibly
use this issue to execute arbitrary code. (CVE-2024-35226)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS smarty3 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1
Ubuntu · 22.04 LTS 22.04:LTS smarty3 3.1.39-2ubuntu1.22.04.2
Ubuntu · 24.04 LTS 24.04:LTS smarty3 3.1.48-1ubuntu0.24.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS smarty3 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1

Vulnerabilities 3

  • High 7.3
    CVE-2024-35226

    PHP Code Injection by malicious attribute in extends-tag in Smarty

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist
  • High 7.1
    CVE-2023-28447 Public exploit

    Cross site scripting vulnerability in Javascript escaping in smarty/smarty

    Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthor…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist
  • Medium 5.4
    CVE-2018-25047

    Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto

    In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.

    smarty3 smarty/smarty smarty3 smarty4 Debian Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2018-25047
  • report
    https://ubuntu.com/security/CVE-2023-28447
  • report
    https://ubuntu.com/security/CVE-2024-35226