Junglewise Threat Intelligence

CVE-2026-62993: Smarty SSRF via redirect bypass in {fetch}

CVE-2026-62993 · Severity: medium · CVSS 6.9 · Published 2026-09-01

Executive brief

Smarty is a popular PHP templating engine that includes a {fetch} function to retrieve remote content. When security policies are active, it validates URLs against a trusted host allowlist, but fails to prevent attackers from exploiting open redirects on trusted hosts to access internal services, effectively bypassing the security control. An attacker who can influence the fetch target and has an open redirect available on a trusted host can perform server-side request forgery to access internal endpoints.

Technical details

The vulnerability exists in Smarty's {fetch} template function when a security policy with a trusted_uri allowlist is active. The Security::isTrustedUri() method validates only the initial URL against the allowlist, but PHP's file_get_contents() function (used to retrieve remote resources) follows HTTP redirects by default. An attacker can craft a fetch request to a trusted URL that contains an open redirect, causing the function to follow the redirect to an attacker-controlled internal endpoint, bypassing the trusted_uri policy. This is a classic server-side request forgery (CWE-918) vulnerability. The attack requires an attacker to control or influence the fetch target URL and an open redirect to exist on an otherwise-trusted host. Fixed in versions 5.8.2 and 4.5.7 by disabling redirect following (follow_location => 0, max_redirects => 1) when a security policy is active.

Affected products

  • Smarty Smarty 5.0.0 to 5.8.1, 4.x before 4.5.7

Timeline

  • 2026-07-20: disclosed: Published in GitHub Advisory Database
  • 2026-06-29: patched: Fixed in Smarty 5.8.2 and 4.5.7
  • 2026-09-01: advisory: NVD published CVE-2026-62993

References

Related threats