# CVE-2026-62993: Smarty SSRF via redirect bypass in {fetch}

Source: https://junglewise.ai/threats/cve-2026-62993-smarty-ssrf-via-redirect-bypass-in-fetch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62993 · Severity: medium · CVSS 4 · Published 2026-08-31

Smarty is a popular PHP templating engine that includes a {fetch} function to retrieve remote content. When security policies are active, it validates URLs against a trusted host allowlist, but fails to prevent attackers from exploiting open redirects on trusted hosts to access internal services, effectively bypassing the security control. An attacker who can influence the fetch target and has an open redirect available on a trusted host can perform server-side request forgery to access internal endpoints.

Technologies: [smarty/smarty (Packagist)](https://junglewise.ai/threats/technologies/smarty-smarty), [Smarty](https://junglewise.ai/threats/technologies/smarty). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Smarty](https://junglewise.ai/threats/vendors/smarty).

## Quick answers

**Is CVE-2026-62993 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62993 being exploited in the wild.

**How severe is CVE-2026-62993?** Medium severity, with a CVSS score of 4, published 31 August 2026.

**Which products and versions are affected?** smarty/smarty (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.8.2; Smarty 5.0.0 to 5.8.1, 4.x before 4.5.7.

**Is there a fix for CVE-2026-62993?** Yes. smarty/smarty (Packagist): upgrade to 5.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62993 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62993?** Check whether you run smarty/smarty (Packagist) or Smarty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- smarty/smarty (Packagist): upgrade to 5.8.2 or later

  ```sh
  composer require smarty/smarty:^5.8.2
  ```


## Technical details

The vulnerability exists in Smarty's {fetch} template function when a security policy with a trusted_uri allowlist is active. The Security::isTrustedUri() method validates only the initial URL against the allowlist, but PHP's file_get_contents() function (used to retrieve remote resources) follows HTTP redirects by default. An attacker can craft a fetch request to a trusted URL that contains an open redirect, causing the function to follow the redirect to an attacker-controlled internal endpoint, bypassing the trusted_uri policy. This is a classic server-side request forgery (CWE-918) vulnerability. The attack requires an attacker to control or influence the fetch target URL and an open redirect to exist on an otherwise-trusted host. Fixed in versions 5.8.2 and 4.5.7 by disabling redirect following (follow_location => 0, max_redirects => 1) when a security policy is active.

## Affected products

- Smarty Smarty 5.0.0 to 5.8.1, 4.x before 4.5.7

## Identifiers

- CVE-2026-62993
- GHSA-cq55-c7wv-pxmq

## Timeline

- 2026-07-20: disclosed: Published in GitHub Advisory Database
- 2026-06-29: patched: Fixed in Smarty 5.8.2 and 4.5.7
- 2026-09-01: advisory: NVD published CVE-2026-62993

## References

- [https://github.com/smarty-php/smarty/security/advisories/GHSA-cq55-c7wv-pxmq](https://github.com/smarty-php/smarty/security/advisories/GHSA-cq55-c7wv-pxmq)
- [https://github.com/smarty-php/smarty/pull/1194](https://github.com/smarty-php/smarty/pull/1194)
- [https://github.com/smarty-php/smarty/commit/31e06fc087a8b5a9b236c1e5dacc1c2850a2c115](https://github.com/smarty-php/smarty/commit/31e06fc087a8b5a9b236c1e5dacc1c2850a2c115)
- [https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90](https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90)
- [https://github.com/smarty-php/smarty/releases/tag/v4.5.7](https://github.com/smarty-php/smarty/releases/tag/v4.5.7)

## Related threats

- [Smarty code injection in template inheritance via nocache hash](https://junglewise.ai/threats/cve-2026-82531-smarty-before-4-5-8-and-5-x-before-5-8-5-contains-a-code)
- [Smarty Security stream restriction bypass in StreamPlugin](https://junglewise.ai/threats/cve-2026-62996-smarty-security-stream-restriction-bypass-in-streamplugin)
- [Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.](https://junglewise.ai/threats/cve-2026-62992-smarty-symlink-path-traversal-in-security-policy)
- [Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag](https://junglewise.ai/threats/cve-2024-35226-smarty-vulnerable-to-php-code-injection-by-malicious-attribute-in)
- [smarty Cross-site Scripting vulnerability in Javascript escaping](https://junglewise.ai/threats/cve-2023-28447-smarty-cross-site-scripting-vulnerability-in-javascript-escaping)