CVE-2026-82531

Katalog CVE

CVSS 8.1 · High EPSS 0,82%

Kerentanan Improper Control of Generation of Code ('Code Injection'). Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/smarty-php/smarty/commit/1cba51cb813563eb61d963c83d28cd59f26b858d
• https://github.com/smarty-php/smarty/commit/c0fdd4824aca4f67e814b50703cfee1dfde41414
• https://github.com/smarty-php/smarty/releases/tag/v4.5.8
• https://github.com/smarty-php/smarty/releases/tag/v5.8.5
• https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x
• https://www.vulncheck.com/advisories/smarty-before-4.5.8-and-5-x-before-5.8.5-php-code-injection-via-extends-i...