Description
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
smarty-php smarty
Default version status: unaffected
0 to < 4.5.8affected5.0.0 to < 5.8.5affected4.5.8unaffected5.8.5unaffected
pkg:composer/smarty/smartyReferences
- https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x ↗
- https://github.com/smarty-php/smarty/commit/c0fdd4824aca4f67e814b50703cfee1dfde41414 ↗
- https://github.com/smarty-php/smarty/commit/1cba51cb813563eb61d963c83d28cd59f26b858d ↗
- https://github.com/smarty-php/smarty/releases/tag/v5.8.5 ↗
- https://github.com/smarty-php/smarty/releases/tag/v4.5.8 ↗
- https://www.vulncheck.com/advisories/smarty-before-4.5.8-and-5-x-before-5.8.5-php-code-injection-via-extends-inheritance-cache ↗