MediumGHSA-6m9f-8vwq-97pmCVE-2009-5054

Smarty Does Not Consider Umask Values When Setting Permissions

Published 2 May 2022 · Updated 4 Dec 2024

Affected package

Affected: <3.0.0-beta4
Fixed in: 3.0.0-beta4

Update to the fixed version for your release line, for example:composer require smarty/smarty:^3.0.0-beta4

Details

Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.

Is GHSA-6m9f-8vwq-97pm in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected smarty/smarty, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2009-5054
Packagegithub.com/smarty-php/smarty
Linkweb.archive.org/web/20101116174040/http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.