Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri() to validate only the initial remote URL against trusted_uri when a security policy was active. For resources handled by file_get_contents(), including HTTPS URLs, PHP followed HTTP redirects by default. An attacker who could supply or influence a fetch target and had an open redirect on a trusted host could redirect the request to an attacker-chosen internal endpoint, bypass the trusted_uri allowlist, and perform server-side request forgery. This issue is fixed in versions 4.5.7 and 5.8.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| smarty-php | smarty | 5.0.0 to before 5.8.2; before 4.5.7 | 5.8.2, 4.5.7 | Patch available | CNA |
| — | smarty/smarty (Packagist) | 5.0.0 to before 5.8.2 | 5.8.2 | Patch available | GHSA-cq55-c7wv-pxmq |
| — | smarty/smarty (Packagist) | before 4.5.7 | 4.5.7 | Patch available | GHSA-cq55-c7wv-pxmq |
- smarty Vendorsmarty-php Affected 5.0.0 to before 5.8.2; before 4.5.7 Fixed in 5.8.2, 4.5.7 Patch available CNA
- smarty/smarty (Packagist) Vendor— Affected 5.0.0 to before 5.8.2 Fixed in 5.8.2 Patch available GHSA-cq55-c7wv-pxmq
- smarty/smarty (Packagist) Vendor— Affected before 4.5.7 Fixed in 4.5.7 Patch available GHSA-cq55-c7wv-pxmq
Remediation
- Fix · CNA smarty (smarty-php) Fixed in 5.8.2, 4.5.7
- Fix · GHSA-cq55-c7wv-pxmq smarty/smarty (Packagist) Fixed in 5.8.2 Advisory →
- Fix · GHSA-cq55-c7wv-pxmq smarty/smarty (Packagist) Fixed in 4.5.7 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-62993
- 2026-10-03 Alias added: GHSA-cq55-c7wv-pxmq
References
Other 7
- https://github.com/smarty-php/smarty/security/advisories/GHSA-cq55-c7wv-pxmq
- https://github.com/smarty-php/smarty/pull/1194
- https://github.com/smarty-php/smarty/commit/31e06fc087a8b5a9b236c1e5dacc1c2850a2c115
- https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90
- https://github.com/smarty-php/smarty/releases/tag/v4.5.7
- https://github.com/smarty-php/smarty/releases/tag/v5.8.2
- https://github.com/smarty-php/smarty
More smarty-php vulnerabilities
- TI-2021-08070 Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring. CVSS 3.1CRITICAL 9.8
- TI-2026-68416 Code injection in Smarty via extends: inheritance cache CVSS 4.0CRITICAL 9.2
- TI-2026-44997 Smarty Security stream restriction bypass through stream: resource CVSS 4.0MEDIUM 6.9
- TI-2009-01585 The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22… CVSS 2.0HIGH 10.0
- TI-2006-06846 PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows… CVSS 3.1CRITICAL 9.8
- TI-2022-11764 PHP Code Injection by malicious block or filename in Smarty CVSS 3.1HIGH 8.8
Sources
- CVE-2026-62993 · CVE Program
- CVE-2026-62993 · NVD
- FIRST EPSS
- GHSA-cq55-c7wv-pxmq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-62993 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences