CVE-2026-62992: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.

CVE-2026-62992 · Severity: medium · CVSS 4 · Published 2026-08-07

Smarty, a popular PHP templating engine, contains a vulnerability that allows unauthorized access to sensitive files on the server. If an attacker can place a symbolic link (a shortcut file) within a trusted directory, they can trick the system into reading files outside of its intended sandbox, such as system configuration or password files. This could lead to the exposure of confidential data but does not allow the attacker to modify files or crash the service.

Technologies: smarty/smarty (Packagist), Smarty. Vendors: Packagist, Smarty.

Quick answers

Is CVE-2026-62992 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62992 being exploited in the wild.
How severe is CVE-2026-62992?
Medium severity, with a CVSS score of 4, published 7 August 2026.
Which products and versions are affected?
smarty/smarty (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.8.2; Smarty >= 5.0.0, < 5.8.2.
Is there a fix for CVE-2026-62992?
Yes. smarty/smarty (Packagist): upgrade to 5.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62992 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-62992?
Check whether you run smarty/smarty (Packagist) or Smarty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • smarty/smarty (Packagist): upgrade to 5.8.2 or later
    composer require smarty/smarty:^5.8.2

Technical details

A path traversal vulnerability exists in Smarty's Security policy due to improper validation of symbolic links in the `Security::_checkDir()` method. The component used `Smarty::_realpath()`, which performs string-based normalization without resolving actual filesystem symlinks. Consequently, if an attacker can place a symlink within a directory defined in `secure_dir` or other trusted paths, the engine will follow that link to read files outside the restricted boundary via `{include}` or `{fetch}` tags. This allows for arbitrary file disclosure of any file readable by the PHP process. The issue is fixed in versions 5.8.2 and 4.5.7 by using native `realpath()` to validate canonical paths.

Affected products

  • smarty-php smarty >= 5.0.0, < 5.8.2
  • smarty-php smarty < 4.5.7

Identifiers

  • CVE-2026-62992
  • GHSA-f6wf-28g6-769x

Timeline

  • 2026-07-20: disclosed: Initial disclosure by wisskid
  • 2026-08-07: advisory: GitHub Advisory published
  • 2026-08-07: patched: Fixes released in versions 5.8.2 and 4.5.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.