# CVE-2026-62996: Smarty Security stream restriction bypass in StreamPlugin

Source: https://junglewise.ai/threats/cve-2026-62996-smarty-security-stream-restriction-bypass-in-streamplugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-07. Updated: 2026-08-07  
License: CC BY 4.0 with a link back

CVE-2026-62996 · Severity: medium · CVSS 4 · Published 2026-08-07

Smarty, a popular PHP templating engine, contains a vulnerability that allows users with template editing privileges to bypass security restrictions and read sensitive local files. Even when security policies are configured to block access to external data streams, an attacker can use a specific 'stream:' prefix to trick the engine into accessing unauthorized files on the server. This could lead to the exposure of configuration files, source code, or other sensitive data readable by the web server process.

Technologies: [smarty/smarty (Packagist)](https://junglewise.ai/threats/technologies/smarty-smarty), [Smarty](https://junglewise.ai/threats/technologies/smarty). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Smarty](https://junglewise.ai/threats/vendors/smarty).

## Quick answers

**Is CVE-2026-62996 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62996 being exploited in the wild.

**How severe is CVE-2026-62996?** Medium severity, with a CVSS score of 4, published 7 August 2026.

**Which products and versions are affected?** smarty/smarty (Packagist) >= 5.0.0, < 5.8.4, ECOSYSTEM:introduced=5.0.0,fixed=5.8.4; Smarty >= 5.0.0, < 5.8.4.

**Is there a fix for CVE-2026-62996?** Yes. smarty/smarty (Packagist): upgrade to 5.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62996 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62996?** Check whether you run smarty/smarty (Packagist) or Smarty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- smarty/smarty (Packagist): upgrade to 5.8.4 or later

  ```sh
  composer require smarty/smarty:^5.8.4
  ```


## Technical details

A path traversal and security bypass vulnerability exists in Smarty's handling of the built-in 'stream:' resource type. In affected versions, `BasePlugin::load()` maps the 'stream' resource directly to `StreamPlugin` before the security check in `Security::isTrustedStream()` is performed. An attacker can use a template include such as `{include file="stream:php://filter/..."}` to bypass the `Security::$streams = null` restriction. The `StreamPlugin::getContent()` method subsequently calls `fopen()` on the nested URI, allowing an attacker to read arbitrary local files or utilize PHP filters to encode and exfiltrate data. This issue is patched in version 5.8.4.

## Affected products

- smarty-php smarty >= 5.0.0, < 5.8.4

## Identifiers

- CVE-2026-62996
- GHSA-rjhh-76wf-8xmw

## Timeline

- 2026-07-20: disclosed
- 2026-08-07: advisory
- 2026-08-07: patched

## References

- [https://api.github.com/users/Faze-up](https://api.github.com/users/Faze-up)
- [https://github.com/Faze-up](https://github.com/Faze-up)
- [https://api.github.com/users/Faze-up/gists%7B/gist_id%7D](https://api.github.com/users/Faze-up/gists%7B/gist_id%7D)
- [https://api.github.com/users/Faze-up/repos](https://api.github.com/users/Faze-up/repos)
- [https://avatars.githubusercontent.com/u/45031662?v=4](https://avatars.githubusercontent.com/u/45031662?v=4)
- [https://api.github.com/users/Faze-up/events%7B/privacy%7D](https://api.github.com/users/Faze-up/events%7B/privacy%7D)

## Related threats

- [Smarty code injection in template inheritance via nocache hash](https://junglewise.ai/threats/cve-2026-82531-smarty-before-4-5-8-and-5-x-before-5-8-5-contains-a-code)
- [Smarty SSRF via redirect bypass in {fetch}](https://junglewise.ai/threats/cve-2026-62993-smarty-ssrf-via-redirect-bypass-in-fetch)
- [Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.](https://junglewise.ai/threats/cve-2026-62992-smarty-symlink-path-traversal-in-security-policy)
- [Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag](https://junglewise.ai/threats/cve-2024-35226-smarty-vulnerable-to-php-code-injection-by-malicious-attribute-in)
- [smarty Cross-site Scripting vulnerability in Javascript escaping](https://junglewise.ai/threats/cve-2023-28447-smarty-cross-site-scripting-vulnerability-in-javascript-escaping)