CVE-2026-62996
Received Received - Intake

Smarty Template Engine PHP Stream Resource Path Traversal

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents outside the intended template/config scope. This issue is fixed in version 5.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-62996
EUVD
EUVD-2026-54499

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
smarty smarty to 5.8.4 (exc)
smarty smarty 5.8.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62996 is a vulnerability in Smarty, a PHP template engine, affecting versions 5.0.0 to 5.8.3. It allows bypassing security restrictions by using nested stream wrappers like php://filter in the stream: resource type. This enables reading arbitrary local files outside the intended template scope, even when security policies are enabled.

Detection Guidance

Check Smarty version with composer show smarty/smarty. If version is between 5.0.0 and 5.8.3, the system is vulnerable. Inspect template files for resource references using stream:php://filter patterns like stream:php://filter/read=convert.base64-encode/resource=.

Review application logs for unauthorized file access attempts or suspicious template includes referencing local file paths.

Impact Analysis

An attacker who can influence or author a template could exploit this to read sensitive files on the server, such as configuration files, source code, or other restricted data. This could lead to information disclosure, privilege escalation, or further attacks if the exposed data is used maliciously.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using affected Smarty versions may face compliance breaches if exploited.

Mitigation Strategies

Upgrade Smarty to version 5.8.4 or later immediately. If upgrading is not possible, disable the stream: resource type in Smarty Security settings and block php://filter wrappers at the PHP or web server level.

Audit all templates for resource references using stream: or php://filter patterns and remove any untrusted references.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart