Description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| smarty-php | smarty | < 3.1.45, >= 4.0.0, < 4.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | smarty3 | 3.1.45-1 | — |
| Debian 14 | smarty4 | 4.1.1-1 | — |
| Debian 13 | smarty3 | 3.1.45-1 | — |
| Debian 13 | smarty4 | 4.1.1-1 | — |
| Debian 12 | smarty3 | 3.1.45-1 | — |
| Debian 12 | smarty4 | 4.1.1-1 | — |
| Debian 11 | smarty3 | 3.1.39-2+deb11u1 | DSA-5151-1 |
| Debian 10 | smarty3 | 3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u1 | DSA-5151-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | smarty3 | 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u6 | DLA-3033-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | gosa | No fix yet | — |
| Ubuntu 26.04 LTS | gosa | No fix yet | — |
| Ubuntu 25.10 | gosa | No fix yet | — |
| Ubuntu 24.04 LTS | gosa | No fix yet | — |
| Ubuntu 22.04 LTS | gosa | No fix yet | — |
| Ubuntu 22.04 LTS | smarty3 | 3.1.39-2ubuntu1.22.04.1 | USN-6012-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | gosa | No fix yet | — |
| Ubuntu 18.04 LTS | gosa | No fix yet | — |
| Ubuntu 16.04 LTS | gosa +2 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | postfixadmin | 3.3.10-2ubuntu0.1~esm1 | USN-6550-1 |
| Ubuntu Pro 20.04 LTS | postfixadmin | 3.2.1-3ubuntu0.1~esm1 | USN-6550-1 |
| Ubuntu Pro 20.04 LTS | smarty3 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | postfixadmin | 3.0.2-2ubuntu0.1~esm1 | USN-6550-1 |
| Ubuntu Pro 18.04 LTS | smarty3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | smarty3 | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
sbani/CVE-2022-29221-PoC ★ 16 · May 25, 2022
CVE-2022-29221 Proof of Concept Code - Smarty RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | smarty/smarty | < 3.1.45 | 3.1.45 | GHSA-634x-pc3q-cf4c |
| Packagist | smarty/smarty | >= 4.0.0, < 4.1.1 | 4.1.1 | GHSA-634x-pc3q-cf4c |
Advisories 4
- USN-6550-1 postfixadmin vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-6012-1 smarty3 vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5151-1 smarty3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3033-1 smarty3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c
- https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd
- https://github.com/smarty-php/smarty/releases/tag/v3.1.45
- https://github.com/smarty-php/smarty/releases/tag/v4.1.1
- [debian-lts-announce] 20220529 [SECURITY] [DLA 3033-1] smarty3 security update mailing-list
- DSA-5151 vendor-advisory
- GLSA-202209-09 vendor-advisory
- FEDORA-2022-52154efd61 vendor-advisory
- FEDORA-2022-d5fc9dcdd7 vendor-advisory