Skip to content
OpenAdvisories

Package · Debian

smarty4

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-62993

    Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and src/FunctionHandler/F…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist
  • Medium 6.9
    CVE-2026-62992

    Smarty: Symlink path traversal out of trusted directories

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist
  • Medium 5.4
    CVE-2018-25047

    Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto

    In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.

    smarty3 smarty/smarty smarty3 smarty4 Debian Ubuntu Packagist