Read the docs
TI-2026-68416 Aliases CVE-2026-82531

Code injection in Smarty via extends: inheritance cache

Priority HIGH 75CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection flaw (CWE-94) where the top-level nocache_hash is not restored during extends: template inheritance, leaving it null. An unauthenticated remote attacker can supply assigned data containing a forged SmartyNocache marker that is copied into the regenerated PHP cache file, so arbitrary PHP code runs when the file is included.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00821 57th percentileScored 2026-11-07
Fix Fixed smarty (smarty-php): 4.5.8, 5.8.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
smarty-phpsmartybefore 4.5.8; 5.0.0 to before 5.8.54.5.8, 5.8.5Patch availableCNA
  • smarty Vendorsmarty-php Affected before 4.5.8; 5.0.0 to before 5.8.5 Fixed in 4.5.8, 5.8.5 Patch available CNA

Remediation

Upgrade Smarty to version 4.5.8 for the 4.x branch or version 5.8.5 for the 5.x branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA smarty (smarty-php) Fixed in 4.5.8, 5.8.5

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-82531

References

Patch 2

Advisory 1

Other 2

  • TI-2021-08070 Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring. CVSS 3.1CRITICAL 9.8
  • TI-2026-44997 Smarty Security stream restriction bypass through stream: resource CVSS 4.0MEDIUM 6.9
  • TI-2009-01585 The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22… CVSS 2.0HIGH 10.0
  • TI-2006-06846 PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-11764 PHP Code Injection by malicious block or filename in Smarty CVSS 3.1HIGH 8.8
  • TI-2017-14689 Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or… CVSS 3.0CRITICAL 9.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences