PatchTheCVEsmarty vulnerabilities and fixes
Recent CVEs affecting smarty, with upgrade or downgrade steps. 9 tracked.
smarty has 9 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 9. Most recent: 2023-09-29. Highest priority: CVE-2021-26120 (score 69/100).
- CVE-2023-41661 MEDIUM 5.9 UPGRADE Auth
- CVE-2023-28447 HIGH 7.1 UPGRADE MITIGATE Smarty is a template engine for PHP
- CVE-2022-29221 HIGH 8.8 UPGRADE MITIGATE Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application l
- CVE-2021-29454 HIGH 8.1 UPGRADE MITIGATE Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application l
- CVE-2021-26120 CRITICAL 9.8 UPGRADE MITIGATE Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.
- CVE-2021-26119 HIGH 7.5 UPGRADE MITIGATE Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.
- CVE-2021-21408 HIGH 8.8 UPGRADE MITIGATE Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application l
- CVE-2020-10375 MEDIUM 5.5 UPGRADE An issue was discovered in New Media Smarty before 9.10
- CVE-2018-25047 MEDIUM 5.4 UPGRADE MITIGATE In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS
FAQ
How do I fix smarty vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is smarty being exploited right now?
None of the tracked smarty CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which smarty CVE should I patch first?
CVE-2021-26120 currently ranks highest (69/100): Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring..