CVE-2026-62993: Smarty SSRF via redirect bypass in {fetch}

CVE-2026-62993 · Severity: medium · CVSS 4 · Published 2026-08-31

Smarty is a popular PHP templating engine that includes a {fetch} function to retrieve remote content. When security policies are active, it validates URLs against a trusted host allowlist, but fails to prevent attackers from exploiting open redirects on trusted hosts to access internal services, effectively bypassing the security control. An attacker who can influence the fetch target and has an open redirect available on a trusted host can perform server-side request forgery to access internal endpoints.

Technologies: smarty/smarty (Packagist), Smarty. Vendors: Packagist, Smarty.

Quick answers

Is CVE-2026-62993 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62993 being exploited in the wild.
How severe is CVE-2026-62993?
Medium severity, with a CVSS score of 4, published 31 August 2026.
Which products and versions are affected?
smarty/smarty (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.8.2; Smarty 5.0.0 to 5.8.1, 4.x before 4.5.7.
Is there a fix for CVE-2026-62993?
Yes. smarty/smarty (Packagist): upgrade to 5.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62993 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-62993?
Check whether you run smarty/smarty (Packagist) or Smarty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • smarty/smarty (Packagist): upgrade to 5.8.2 or later
    composer require smarty/smarty:^5.8.2

Technical details

The vulnerability exists in Smarty's {fetch} template function when a security policy with a trusted_uri allowlist is active. The Security::isTrustedUri() method validates only the initial URL against the allowlist, but PHP's file_get_contents() function (used to retrieve remote resources) follows HTTP redirects by default. An attacker can craft a fetch request to a trusted URL that contains an open redirect, causing the function to follow the redirect to an attacker-controlled internal endpoint, bypassing the trusted_uri policy. This is a classic server-side request forgery (CWE-918) vulnerability. The attack requires an attacker to control or influence the fetch target URL and an open redirect to exist on an otherwise-trusted host. Fixed in versions 5.8.2 and 4.5.7 by disabling redirect following (follow_location => 0, max_redirects => 1) when a security policy is active.

Affected products

  • Smarty Smarty 5.0.0 to 5.8.1, 4.x before 4.5.7

Identifiers

  • CVE-2026-62993
  • GHSA-cq55-c7wv-pxmq

Timeline

  • 2026-07-20: disclosed: Published in GitHub Advisory Database
  • 2026-06-29: patched: Fixed in Smarty 5.8.2 and 4.5.7
  • 2026-09-01: advisory: NVD published CVE-2026-62993

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.