---
id: CVE-2026-62992
title: >-
  Smarty is a template engine for PHP, facilitating the separation of
  presentation (HTML/CSS) from application logic
summary: >-
  Smarty is a template engine for PHP, facilitating the separation of
  presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on
  the 4.x line), Security::_checkDir() does not fully resolve symbolic links
  before validating…
severity: medium
cwe:
  - CWE-22
  - CWE-61
vendor: smarty
product: smarty/smarty
affected:
  - 'smarty/smarty >= 5.0.0, < 5.8.2'
  - smarty/smarty < 4.5.7
patched:
  - smarty/smarty 5.8.2
  - smarty/smarty 4.5.7
published: '2026-08-07'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62992'
references:
  - url: >-
      https://github.com/smarty-php/smarty/commit/99c048ce7a590c519b79fbd38ad0143a08183a1f
    label: security-advisories@github.com
  - url: >-
      https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90
    label: security-advisories@github.com
  - url: 'https://github.com/smarty-php/smarty/releases/tag/v4.5.7'
    label: security-advisories@github.com
  - url: 'https://github.com/smarty-php/smarty/releases/tag/v5.8.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/smarty-php/smarty/security/advisories/GHSA-f6wf-28g6-769x
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-f6wf-28g6-769x'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00533
epssPercentile: 0.42534
aliases:
  - GHSA-f6wf-28g6-769x
ecosystem: composer
ingestedAt: '2026-08-07T15:14:28.872Z'
---

## Overview

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-62992)

Affected packages:

- `smarty/smarty >= 5.0.0, < 5.8.2`
- `smarty/smarty < 4.5.7`

Patched in:

- `smarty/smarty 5.8.2`
- `smarty/smarty 4.5.7`

Source: https://github.com/advisories/GHSA-f6wf-28g6-769x