CVE-2024-35226CWE-94

PHP Code Injection by malicious attribute in extends-tag in Smarty

High · published May 28, 2024

CVSS v3.1
7.3
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-05-28T20:55Z
EPSS history
Timeline
  • 28 MAY 20:55Z
    PHP Code Injection by malicious attribute in extends-tag in Smarty
    cvelistv5