Description
Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | smarty3 | 3.1.33+20180830.1.3a78a21f+selfpack1-1 | — |
| Debian 13 | smarty3 | 3.1.33+20180830.1.3a78a21f+selfpack1-1 | — |
| Debian 12 | smarty3 | 3.1.33+20180830.1.3a78a21f+selfpack1-1 | — |
| Debian 9 | smarty3 | 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u2 | DLA-2618-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | smarty3 | 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1 | USN-5348-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | smarty/smarty | < 3.1.33 | 3.1.33 | GHSA-7gfx-wxfh-7rvm |
Advisories 2
- DLA-2618-1 smarty3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5348-1 smarty3 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- https://github.com/smarty-php/smarty/commit/2e081a51b1effddb23f87952959139ac62654d50
- https://github.com/smarty-php/smarty/commit/f9ca3c63d1250bb56b2bda609dcc9dd81f0065f8
- https://github.com/smarty-php/smarty/commit/c9dbe1d08c081912d02bd851d1d1b6388f6133d1
- https://github.com/smarty-php/smarty/commit/8d21f38dc35c4cd6b31c2f23fc9b8e5adbc56dfe
- https://github.com/smarty-php/smarty/commit/bcedfd6b58bed4a7366336979ebaa5a240581531
- https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180420-01_Smarty_Path_Traversal
- [debian-lts-announce] 20210405 [SECURITY] [DLA 2618-1] smarty3 security update mailing-list
- [debian-lts-announce] 20210416 [SECURITY] [DLA 2618-2] smarty3 regression update mailing-list
- [debian-lts-announce] 20211020 [SECURITY] [DLA 2618-3] smarty3 regression update mailing-list