{"id":"GHSA-6m9f-8vwq-97pm","aliases":["CVE-2009-5054"],"title":"Smarty Does Not Consider Umask Values When Setting Permissions","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.","severity":"medium","score":null,"published":"2022-05-02T04:00:47.000Z","modified":"2024-12-04T05:46:50.965Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"smarty/smarty","sources":[{"name":"OSV · GHSA-6m9f-8vwq-97pm","url":"https://osv.dev/vulnerability/GHSA-6m9f-8vwq-97pm"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.0.0-beta4"}],"type":"ECOSYSTEM"}],"versions":["v2.6.24","v2.6.25","v2.6.26","v2.6.27","v2.6.28","v2.6.29","v2.6.30","v2.6.31","v2.6.33"],"fixed":["3.0.0-beta4"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2009-5054","https://github.com/smarty-php/smarty","https://web.archive.org/web/20101116174040/http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt"],"sources":[{"name":"OSV","id":"GHSA-6m9f-8vwq-97pm","modified":"2024-12-04T05:46:50.965677Z","url":"https://osv.dev/vulnerability/GHSA-6m9f-8vwq-97pm"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T22:55:31.701Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}