CVE-2026-82531

Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

State: Published
Severity: 9.2 Critical
Published: Oct 6, 2026
Updated: Oct 6, 2026
Reserved: Aug 29, 2026

Description

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
smartysmarty-php	before 4.5.8Affected 5.0.0 to before 5.8.5Affected 4.5.8Not affected 5.8.5Not affected

References

GitHub Security Advisory (GHSA-3w63-v7pm-cq9x)vendor-advisory
https://github.com/smarty-php/smarty/commit/c0fdd4824aca4f67e814b50703cfee1dfde41414patch
https://github.com/smarty-php/smarty/commit/1cba51cb813563eb61d963c83d28cd59f26b858dpatch
smarty v5.8.5 Release Notesrelease-notes
smarty v4.5.8 Release Notesrelease-notes
VulnCheck Advisory: Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cachethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.