CVE-2026-62992

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62992
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62992.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62992
Aliases
Downstream
Published
2026-08-07T15:02:28Z
Modified
2026-09-11T03:30:50Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Smarty: Symlink path traversal out of trusted directories
Details

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-61"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62992.json"
}
References

Affected packages

Git / github.com/smarty-php/smarty

Affected ranges

Type
GIT
Repo
https://github.com/smarty-php/smarty
Events
Introduced
e161babbd49840de2ae7a5e358e59f52d66c1f0a
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
06594a114931ab6fea76b12f0207c5903cf01f8c
Fixed
838d6ad1c635f8a6bafc08d791b8af18d8304b3a
Fixed
99c048ce7a590c519b79fbd38ad0143a08183a1f
Fixed
a1ccdb0518021a559b4066c37b76a42c86bbce90
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.8.2"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "4.5.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
checkout
v2.*
v2.6.24
v2.6.25
v2.6.26
v2.6.27
v2.6.28
v3.*
v3.1.11
v3.1.12
v3.1.13
v3.1.14
v3.1.15
v3.1.16
v3.1.17
v3.1.18
v3.1.19
v3.1.20
v3.1.21
v3.1.23
v3.1.24
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.29
v3.1.30
v3.1.31
v3.1.32
v3.1.33
v3.1.34
v3.1.35
v3.1.36
v3.1.37
v3.1.37.1
v3.1.38
v3.1.39
v3.1.40
v4.*
v4.0.0
v4.0.0-rc.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.4.0
v4.4.1
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v5.*
v5.0.0
v5.1.0
v5.2.0
v5.3.0
v5.3.1
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.5.0
v5.5.1
v5.5.2
v5.6.0
v5.7.0
v5.8.0
v5.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62992.json"