CVE-2024-35226

Name	CVE-2024-35226
Description	Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3956-1
Debian Bugs	1072529, 1072530

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
smarty3 (PTS)	bullseye	3.1.39-2+deb11u1	vulnerable
	bullseye (security)	3.1.39-2+deb11u2	fixed
	bookworm	3.1.47-2	vulnerable
	sid	3.1.48-2	fixed
smarty4 (PTS)	bookworm	4.3.0-1+deb12u1	vulnerable
	sid, trixie	4.5.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
smarty3	source	bullseye	3.1.39-2+deb11u2	DLA-3956-1
smarty3	source	(unstable)	3.1.48-2		1072530
smarty4	source	(unstable)	4.5.4-1		1072529

Notes

https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w
https://github.com/smarty-php/smarty/commit/76881c8d33d80648f70c9b0339f770f5f69a87a2 (v4.5.3)
https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a (v5.2.0)