CVE-2026-62992
Received Received - Intake

Symbolic Link Bypass in Smarty Template Engine

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-62992
EUVD
EUVD-2026-54498

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
smarty smarty to 5.8.2 (inc)
smarty smarty to 4.5.7 (inc)
smarty smarty From 5.0.0 (inc) to 5.8.2 (exc)
smarty smarty From 4.5.7 (inc) to 5.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in Smarty PHP template engine versions before 5.8.2 and 4.5.7. The Security::_checkDir() function fails to fully resolve symbolic links before validating file paths within trusted directories. An attacker can exploit this by placing a symlink in a trusted directory that points outside the intended secure area. When a template uses {include} or {fetch} to reference this symlink, it can read arbitrary files accessible to the PHP process, such as sensitive system files.

Detection Guidance

Check Smarty version with: grep -r "smarty/smarty" /path/to/composer.lock or composer show smarty/smarty. If version is below 5.8.2 or 4.5.7, the system is vulnerable. Inspect template directories for unexpected symlinks using find /path/to/templates -type l -ls. Review logs for suspicious {include} or {fetch} calls referencing files outside configured secure_dir.

Impact Analysis

If you use Smarty PHP versions before 5.8.2 or 4.5.7 with security policies enabled, an attacker could read sensitive files on your server by exploiting this vulnerability. This includes configuration files, user data, or system files like /etc/passwd. The impact is limited to file read access, but it could expose confidential information if the PHP process has access to sensitive files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). If exploited, it could result in data breaches exposing personal or health information, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Smarty to version 5.8.2 or 4.5.7 immediately. If upgrading is not possible, restrict write access to template and config directories and remove all symlinks within secure_dir paths. Disable {include} and {fetch} for untrusted templates until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62992. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart