Description
The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used by Serendipity (S9Y) and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | smarty | 2.6.14-1etch1 | DSA-1520-1 |
| Debian 3.1 | smarty | 2.6.9-1sarge1 | DSA-1520-1 |
Advisories 1
- DSA-1520-1 smarty - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 29398 third-party-advisory
- 29241 third-party-advisory
- DSA-1520 vendor-advisory
- http://www.phpinsider.com/smarty-forum/viewtopic.php?p=47652
- GLSA-201111-04 vendor-advisory
- http://www.smarty.net/misc/NEWS
- 29405 third-party-advisory
- FEDORA-2008-2656 vendor-advisory
- 29392 third-party-advisory
- 29839 third-party-advisory
- SUSE-SR:2008:007 vendor-advisory
- smarty-modifierregexreplace-security-bypass(41002) vdb-entry
- FEDORA-2008-2587 vendor-advisory
- 28105 vdb-entry
- FEDORA-2008-2650 vendor-advisory
- http://blog.s9y.org/archives/191-Serendipity-1.3-beta1-released.html
- 29562 third-party-advisory