CVE-2026-62992

Name	CVE-2026-62992
Description	Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1145020

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
smarty3 (PTS)	bookworm, bookworm (security)	3.1.47-2+deb12u1	vulnerable
	forky, sid, trixie	3.1.48-2	vulnerable
smarty4 (PTS)	bookworm, bookworm (security)	4.3.0-1+deb12u2	vulnerable
	forky, sid, trixie	4.5.5-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
smarty3	source	(unstable)	(unfixed)
smarty4	source	(unstable)	(unfixed)			1145020

Notes

[trixie] - smarty4 <no-dsa> (Minor issue)
[trixie] - smarty3 <no-dsa> (Minor issue)
https://github.com/smarty-php/smarty/security/advisories/GHSA-f6wf-28g6-769x
Fixed by: https://github.com/smarty-php/smarty/commit/99c048ce7a590c519b79fbd38ad0143a08183a1f (v5.8.2)
Fixed by: https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90 (v4.5.7)