CVE-2026-82531

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.8 Smarty versions 5.x prior to 5.8.5

Description A code injection flaw exists during multi-component template inheritance where the top-level nocache hash is not restored and remains null. This allows an attacker to provide assigned data containing a forged SmartyNocache marker. This marker is then copied directly into the regenerated PHP cache file, leading to remote code execution when the file is included.

Recommendations Update to version 4.5.8 or later. Update to version 5.8.5 or later.