CVE-2026-62992: Smarty Package Symlink Path Traversal Vulnerability
Summary
CVE-2026-62992: Smarty: Symlink path traversal out of trusted directories. Affects smarty/smarty across 2 version ranges.
< 4.5.7
>= 5.0.0, < 5.8.2
Fixed in 4.5.7 or 5.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Smarty is a popular template engine for PHP, widely used for its ability to separate the presentation layer from the business logic. It allows developers to create dynamic web pages with ease. However, when its Security policy is enabled, it restricts access to local files through a configuration known as secure_dir. This vulnerability arises from the way Smarty handles symbolic links within trusted directories, potentially exposing sensitive files to unauthorized access.
Vulnerability Detail
The vulnerability stems from Smarty's Security::_checkDir() method, which uses Smarty::_realpath() to normalize file paths without following symbolic links. This oversight allows an attacker to create a symlink within a trusted directory that points to an arbitrary file outside the secure_dir boundary. If a template references this symlink, it can lead to unauthorized reading of sensitive files, such as /etc/passwd, thus compromising confidentiality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.74.5.7composer require smarty/smarty:4.5.7 -
>= 5.0.0, < 5.8.25.8.2composer require smarty/smarty:5.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, ensure that no untrusted symlinks can be created within any directory listed in secure_dir or the trusted template directories. Restrict write access to these directories to trusted processes only.
Conclusion
The CVE-2026-62992 vulnerability in the Smarty package poses a significant risk due to its potential to expose sensitive files through symlink path traversal. It is crucial for developers using Smarty to update to the patched versions and implement recommended workarounds to safeguard their applications.
See every vulnerability recorded for smarty/smarty →
FAQ
The vulnerability allows an attacker to read arbitrary files that are accessible by the PHP process, potentially exposing sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Versions prior to 5.8.2 in the 5.x series and prior to 4.5.7 in the 4.x series are affected by this vulnerability.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
If an immediate update is not possible, implement the suggested workarounds to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for smarty/smarty.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
