GHSA-6m9f-8vwq-97pm
Smarty Does Not Consider Umask Values When Setting Permissions
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | smarty/smarty | < 3.0.0-beta4 | 3.0.0-beta4 |
Details
As written in the advisory (Markdown source, shown as plain text).
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
References
External links from the advisory. They lead to third-party sites.