CVE-2024-35226

What it actually does

Template authors can inject arbitrary PHP code by supplying a malicious filename to an extends-tag, resulting in code execution during template processing.

Why it matters to the business

Organizations using Smarty templates risk complete server compromise if template authors cannot be fully trusted, potentially exposing sensitive data or disrupting web services.

How an attack unfolds

An attacker with template authoring access crafts a specially named file that, when referenced via an extends-tag, causes the template engine to interpret and execute embedded PHP during rendering.

How to fix it

Upgrade smarty-php/smarty to commit 0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a or later; no patch exists for the v3 branch and no workarounds are available.

How to confirm the fix worked

Verify the Smarty installation is at or beyond the fixed commit, attempt to reproduce the vulnerability with a test malicious filename in an extends-tag, and confirm the code no longer executes.

Typical attack path

1. Locate a web application using the Smarty template engine
2. Obtain or assume template authoring privileges
3. Create or upload a file with a malicious name containing PHP code
4. Reference the file using an extends-tag in a template
5. Trigger template compilation or rendering to execute the injected code

How to detect it

Review web server and application logs for unusual template filenames or extends-tag references; inspect template compilation artifacts and server process activity for unexpected PHP execution traces.

What your security team should do

• Immediately update Smarty to the fixed commit across all instances
• Restrict template authoring permissions to trusted users only
• Audit all existing templates for suspicious extends-tag usage
• Implement runtime monitoring for unexpected PHP execution in template contexts