CVE-2026-82531GHSA-3W63-V7PM-CQ9X
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 4.5.8, 5.8.5
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: poc
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.
Affected versions
- smarty-php smarty
fixed in 4.5.8; From 5.0.0 · fixed in 5.8.5