Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Smarty Template Engine Allows Malicious PHP Code Execution

CVE-2021-29454 · published 4 years ago
Summary

A security flaw in Smarty's math function allows attackers to run unauthorized PHP code. This could potentially allow hackers to access sensitive data or take control of the system. Upgrade to Smarty version 3.1.42 or 4.0.2 to fix the issue.

What to do
  • Update smarty smarty to version 3.1.42.
  • Update smarty smarty to version 4.0.2.
Affected software
Ecosystem VendorProductAffected versions
composer smarty smarty < 3.1.42
>= 4.0.0, < 4.0.2
Fix: upgrade to 3.1.42
– debian debian_linux 9.0
10.0
11.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
– fedoraproject fedora 36
37
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Original advisory text
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code...
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-74Injection
Timeline
Published10 Jan 2022
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-29gp-2c3m-3j6m · GHSA
CVE-2021-29454 · NVD
Track software like this
Free during beta