CVE-2026-62996

Name of the Vulnerable Software and Affected Versions Smarty versions 5.0.0 through 5.8.3

Description Smarty's handling of the stream: resource name does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template. This allows a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process, even when Smarty Security is enabled and all streams are disabled via Security::$streams = null. An attacker capable of authoring or influencing a template's resource reference can bypass security restrictions and the trusted-template-directory check to disclose sensitive file contents. The issue occurs because BasePlugin::load() maps the stream resource directly to StreamPlugin before security checks are applied, and StreamPlugin::getContent() subsequently calls fopen() on the nested URI. Relevant functions include BasePlugin::load(), StreamPlugin::getContent(), and Security::isTrustedStream().

Recommendations Update to version 5.8.4. As a temporary mitigation, restrict the ability of untrusted users to author or influence template resource references.