{"id":"GHSA-4rmg-292m-wg3w","aliases":["CVE-2024-35226"],"title":"Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Impact\nTemplate authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.\n\n### Patches\nPlease upgrade to the most recent version of Smarty v4 or v5. There is no patch for v3.","severity":"high","score":7.3,"published":"2024-05-29T18:44:30.000Z","modified":"2025-11-04T17:06:06.964Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"smarty/smarty","sources":[{"name":"OSV · GHSA-4rmg-292m-wg3w","url":"https://osv.dev/vulnerability/GHSA-4rmg-292m-wg3w"}],"ranges":[{"events":[{"introduced":"5.0.0"},{"fixed":"5.1.1"}],"type":"ECOSYSTEM"}],"versions":["v5.0.0","v5.0.1","v5.0.2","v5.1.0"],"fixed":["5.1.1"]},{"ecosystem":"Packagist","name":"smarty/smarty","sources":[{"name":"OSV · GHSA-4rmg-292m-wg3w","url":"https://osv.dev/vulnerability/GHSA-4rmg-292m-wg3w"}],"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"4.5.3"}],"type":"ECOSYSTEM"}],"versions":["v3.1.11","v3.1.12","v3.1.13","v3.1.14","v3.1.15","v3.1.16","v3.1.17","v3.1.18","v3.1.19","v3.1.20","v3.1.21","v3.1.23","v3.1.24","v3.1.25","v3.1.26","v3.1.27","v3.1.28","v3.1.29","v3.1.30","v3.1.31","v3.1.32","v3.1.33","v3.1.34","v3.1.35","v3.1.36","v3.1.37","v3.1.37.1","v3.1.38","v3.1.39","v3.1.40","v3.1.41","v3.1.42","v3.1.43","v3.1.44","v3.1.45","v3.1.46","v3.1.47","v3.1.48","v4.0.0","v4.0.0-rc.0","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.1.0","v4.1.1","v4.2.0","v4.2.1","v4.3.0","v4.3.1","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.4.0","v4.4.1","v4.5.0","v4.5.1","v4.5.2"],"fixed":["4.5.3"]}],"sourceAffected":[],"references":["https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w","https://nvd.nist.gov/vuln/detail/CVE-2024-35226","https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a","https://github.com/smarty-php/smarty","https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html"],"sources":[{"name":"OSV","id":"GHSA-4rmg-292m-wg3w","modified":"2025-11-04T17:06:06.964777Z","url":"https://osv.dev/vulnerability/GHSA-4rmg-292m-wg3w"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","score":7.3}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:50:31.383Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}