AIKIDO-2026-418711
smarty/smarty is vulnerable to Remote Code Execution (RCE)
81
High Risk
This Affects:
smarty/smartyTL;DR
removeNoCacheHash() rebuilds the nocache-marker split from the top-level nocache_hash, which {extends} inheritance never restores. Assigned output can therefore be copied verbatim into the generated PHP cache file and run when that cache is included. The fix ignores an empty nocache hash and treats forged markers as ordinary output.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and templates are rendered through {extends} inheritance with untrusted assigned data.
Background info
smarty/smarty is vulnerable to Remote Code Execution (RCE) in versions 3.0.0 - 4.5.7 and 5.0.0 - 5.8.4.
How to fix this
Upgrade the smarty/smarty library to the patch version.
Links
GitHub Releases
Fix Commits
github.com/smarty-php/smarty/commit/1cba51cb813563eb61d963c83d28cd59f26b858dgithub.com/smarty-php/smarty/commit/c0fdd4824aca4f67e814b50703cfee1dfde41414
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.