CVE-2026-62993: Smarty Package SSRF via Redirect Bypass of Trusted URI
Summary
CVE-2026-62993: Smarty: SSRF via redirect bypass of trusted_uri using {fetch}. Affects smarty/smarty across 2 version ranges.
< 4.5.7
>= 5.0.0, < 5.8.2
Fixed in 4.5.7 or 5.8.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Smarty is a popular open-source template engine for PHP, widely used for its flexibility and ease of integration with various frameworks. It allows developers to separate PHP logic from HTML presentation, enhancing code maintainability. However, it has a vulnerability that can lead to server-side request forgery (SSRF) when fetching remote resources under certain conditions.
Vulnerability Detail
The vulnerability arises when the Smarty {fetch} function is used with a security policy that validates URLs against a trusted_uri allowlist. If a non-http scheme (like https) is used, the function reads the resource with file_get_contents(), which follows HTTP redirects by default. This behavior can be exploited if an open redirect exists on a trusted host, allowing an attacker to redirect requests to internal endpoints, thus bypassing the trusted_uri policy and potentially compromising the server's security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.74.5.7composer require smarty/smarty:4.5.7 -
>= 5.0.0, < 5.8.25.8.2composer require smarty/smarty:5.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid fetching remote resources from templates that are under untrusted control. Additionally, ensure that hosts listed in the trusted_uri do not expose open redirects.
Conclusion
In summary, CVE-2026-62993 is a significant vulnerability in the Smarty template engine that can lead to SSRF attacks. It is crucial to update to the patched versions to mitigate the risk and ensure the security of your applications.
See every vulnerability recorded for smarty/smarty →
FAQ
CVE-2026-62993 is a vulnerability in the Smarty template engine that allows server-side request forgery (SSRF) through a redirect bypass of the trusted_uri policy.
If exploited, this vulnerability can allow attackers to make unauthorized requests to internal services, potentially leading to data breaches or further exploitation of your server.
Smarty versions prior to 5.8.2 and 4.5.7 are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. You can access the Vulert playground at Vulert Scanner without any signup.
The CVSS score of this vulnerability is 6.9, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for smarty/smarty.
