HighGHSA-4rmg-292m-wg3wCVE-2024-35226
Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag
Published 29 May 2024 · Updated 4 Nov 2025
Affected packages
smarty/smartyComposer
- Affected
- >=5.0.0 <5.1.1
- Fixed in
- 5.1.1
Update to the fixed version for your release line, for example:
composer require smarty/smarty:^5.1.1smarty/smartyComposer
- Affected
- >=3.0.0 <4.5.3
- Fixed in
- 4.5.3
Update to the fixed version for your release line, for example:
composer require smarty/smarty:^4.5.3Details
Impact
Template authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.
Patches
Please upgrade to the most recent version of Smarty v4 or v5. There is no patch for v3.
Is GHSA-4rmg-292m-wg3w in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected smarty/smarty, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.