~ / search / GHSA-634x-pc3q-cf4c

GHSA-634x-pc3q-cf4c

PHP Code Injection by malicious block or filename in Smarty

Source: GitHub Advisory Database (reviewed) High CVE-2022-29221

Packages

EcosystemPackageAffectedFixed in
Packagist smarty/smarty < 3.1.45 3.1.45
Packagist smarty/smarty >= 4.0.0, < 4.1.1 4.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Template authors could inject php code by choosing a malicous {block} name or {include} file name. Sites that cannot fully trust template authors should update asap. ### Patches Please upgrade to the most recent version of Smarty v3 or v4. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ ### References _Are there any links users can visit to find out more?_ ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)

References

External links from the advisory. They lead to third-party sites.