Quick answers
- Is CVE-2026-62996 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62996 being exploited in the wild.
- How severe is CVE-2026-62996?
- Medium severity, with a CVSS score of 4, published 7 August 2026.
- Which products and versions are affected?
- smarty/smarty (Packagist) >= 5.0.0, < 5.8.4, ECOSYSTEM:introduced=5.0.0,fixed=5.8.4; Smarty >= 5.0.0, < 5.8.4.
- Is there a fix for CVE-2026-62996?
- Yes. smarty/smarty (Packagist): upgrade to 5.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62996 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-62996?
- Check whether you run smarty/smarty (Packagist) or Smarty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- smarty/smarty (Packagist): upgrade to 5.8.4 or later
composer require smarty/smarty:^5.8.4
Technical details
A path traversal and security bypass vulnerability exists in Smarty's handling of the built-in 'stream:' resource type. In affected versions, `BasePlugin::load()` maps the 'stream' resource directly to `StreamPlugin` before the security check in `Security::isTrustedStream()` is performed. An attacker can use a template include such as `{include file="stream:php://filter/..."}` to bypass the `Security::$streams = null` restriction. The `StreamPlugin::getContent()` method subsequently calls `fopen()` on the nested URI, allowing an attacker to read arbitrary local files or utilize PHP filters to encode and exfiltrate data. This issue is patched in version 5.8.4.
Affected products
- smarty-php smarty >= 5.0.0, < 5.8.4
Identifiers
- CVE-2026-62996
- GHSA-rjhh-76wf-8xmw
Timeline
- 2026-07-20: disclosed
- 2026-08-07: advisory
- 2026-08-07: patched