CVE-2026-62992

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 5.8.2 Smarty versions prior to 4.5.7

Description When the security policy is enabled, the Security:: checkDir() function fails to fully resolve symbolic links before validating that a requested path is within a configured secure directory. The trust check uses Smarty:: realpath(), which only normalizes the path as a string and does not follow symbolic links. Consequently, an attacker who can place or reference a symlink within a trusted directory (such as a template or config directory) can bypass the containment check to read arbitrary files accessible to the PHP process, such as /etc/passwd, via {include} and {fetch} tags.

Recommendations Update to version 5.8.2 or later. Update to version 4.5.7 or later. Restrict write access to directories listed in secure dir and trusted template directories to trusted processes only to ensure no untrusted symlinks can be created.