Executive brief
Smarty, a popular PHP templating engine, contains a vulnerability that allows users with template editing privileges to bypass security restrictions and read sensitive local files. Even when security policies are configured to block access to external data streams, an attacker can use a specific 'stream:' prefix to trick the engine into accessing unauthorized files on the server. This could lead to the exposure of configuration files, source code, or other sensitive data readable by the web server process.
Technical details
A path traversal and security bypass vulnerability exists in Smarty's handling of the built-in 'stream:' resource type. In affected versions, `BasePlugin::load()` maps the 'stream' resource directly to `StreamPlugin` before the security check in `Security::isTrustedStream()` is performed. An attacker can use a template include such as `{include file="stream:php://filter/..."}` to bypass the `Security::$streams = null` restriction. The `StreamPlugin::getContent()` method subsequently calls `fopen()` on the nested URI, allowing an attacker to read arbitrary local files or utilize PHP filters to encode and exfiltrate data. This issue is patched in version 5.8.4.
Affected products
- smarty-php smarty >= 5.0.0, < 5.8.4
Timeline
- 2026-07-20: disclosed
- 2026-08-07: advisory
- 2026-08-07: patched