Executive brief
Smarty, a popular PHP templating engine, contains a vulnerability that allows unauthorized access to sensitive files on the server. If an attacker can place a symbolic link (a shortcut file) within a trusted directory, they can trick the system into reading files outside of its intended sandbox, such as system configuration or password files. This could lead to the exposure of confidential data but does not allow the attacker to modify files or crash the service.
Technical details
A path traversal vulnerability exists in Smarty's Security policy due to improper validation of symbolic links in the `Security::_checkDir()` method. The component used `Smarty::_realpath()`, which performs string-based normalization without resolving actual filesystem symlinks. Consequently, if an attacker can place a symlink within a directory defined in `secure_dir` or other trusted paths, the engine will follow that link to read files outside the restricted boundary via `{include}` or `{fetch}` tags. This allows for arbitrary file disclosure of any file readable by the PHP process. The issue is fixed in versions 5.8.2 and 4.5.7 by using native `realpath()` to validate canonical paths.
Affected products
- smarty-php smarty >= 5.0.0, < 5.8.2
- smarty-php smarty < 4.5.7
Timeline
- 2026-07-20: disclosed: Initial disclosure by wisskid
- 2026-08-07: advisory: GitHub Advisory published
- 2026-08-07: patched: Fixes released in versions 5.8.2 and 4.5.7
References
- https://github.com/smarty-php/smarty/security/advisories/GHSA-f6wf-28g6-769x
- https://github.com/smarty-php/smarty/commit/99c048ce7a590c519b79fbd38ad0143a08183a1f
- https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90
- https://github.com/smarty-php/smarty/releases/tag/v4.5.7
- https://github.com/smarty-php/smarty/releases/tag/v5.8.2
- https://api.github.com/repos/smarty-php/smarty/security-advisories/GHSA-f6wf-28g6-769x