{"id":"CVE-2026-62993","title":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic","summary":"Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and…","severity":"medium","cwe":["CWE-918"],"vendor":"smarty","product":"smarty/smarty","affected":["smarty/smarty >= 5.0.0, < 5.8.2","smarty/smarty < 4.5.7"],"patched":["smarty/smarty 5.8.2","smarty/smarty 4.5.7"],"published":"2026-08-31","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:11:31.703","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62993","references":[{"url":"https://github.com/smarty-php/smarty/commit/31e06fc087a8b5a9b236c1e5dacc1c2850a2c115","label":"security-advisories@github.com"},{"url":"https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90","label":"security-advisories@github.com"},{"url":"https://github.com/smarty-php/smarty/pull/1194","label":"security-advisories@github.com"},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.5.7","label":"security-advisories@github.com"},{"url":"https://github.com/smarty-php/smarty/releases/tag/v5.8.2","label":"security-advisories@github.com"},{"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-cq55-c7wv-pxmq","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62993"},{"url":"https://github.com/advisories/GHSA-cq55-c7wv-pxmq"}],"tags":["nvd","ghsa","composer"],"epss":0.0042,"epssPercentile":0.36005,"aliases":["GHSA-cq55-c7wv-pxmq"],"ecosystem":"composer","ingestedAt":"2026-09-01T17:29:54.760Z","slug":"CVE-2026-62993","body":"## Overview\n\nSmarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri() to validate only the initial remote URL against trusted_uri when a security policy was active. For resources handled by file_get_contents(), including HTTPS URLs, PHP followed HTTP redirects by default. An attacker who could supply or influence a fetch target and had an open redirect on a trusted host could redirect the request to an attacker-chosen internal endpoint, bypass the trusted_uri allowlist, and perform server-side request forgery. This issue is fixed in versions 4.5.7 and 5.8.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-62993)\n\nAffected packages:\n\n- `smarty/smarty >= 5.0.0, < 5.8.2`\n- `smarty/smarty < 4.5.7`\n\nPatched in:\n\n- `smarty/smarty 5.8.2`\n- `smarty/smarty 4.5.7`\n\nSource: https://github.com/advisories/GHSA-cq55-c7wv-pxmq","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}