Skip to content
OpenAdvisories
High USN-7377-1 1 CVE

smarty vulnerability

Published Mar 27, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Smarty did not properly sanitize template file
names. An attacker could possibly use this issue to cause Smarty to
crash, resulting in a denial of service, or possibly execute arbitrary
code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS smarty4 4.3.1-1ubuntu0.24.04.1

Vulnerabilities 1

  • High 7.3
    CVE-2024-35226

    PHP Code Injection by malicious attribute in extends-tag in Smarty

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2024-35226