~ / search / GHSA-4h9c-v5vg-5m6m

GHSA-4h9c-v5vg-5m6m

Access to restricted PHP code by dynamic static class access in smarty

Source: GitHub Advisory Database (reviewed) High CVE-2021-21408

Packages

EcosystemPackageAffectedFixed in
Packagist smarty/smarty < 3.1.43 3.1.43
Packagist smarty/smarty >= 4.0.0, < 4.0.3 4.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Template authors could run restricted static php methods. ### Patches Please upgrade to 3.1.40 or higher. ### References See the [documentation on Smarty security features](https://www.smarty.net/docs/en/advanced.features.tpl#advanced.features.security) on the static_classes access filter. ### For more information If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)

References

External links from the advisory. They lead to third-party sites.