Sandbox escape through template_object in smarty

HIGH 7.5CVE-2021-26119 · GHSA-w5hr-jm4j-9jvq · Published 22/02/2021 · updated 17/06/2026

In short

CVE-2021-26119 is a HIGH (CVSS 7.5) vulnerability affecting smarty/smarty, smarty (smarty).
Chance of exploitation in the next 30 days (EPSS): 8.5%, higher than 95.0% of all vulnerabilities.
Fix: update to 3.1.39 or later.

Package	Affected versions	Patched versions
smarty/smarty Packagist	`< 3.1.39`	`3.1.39`
smarty smarty	`< 3.1.39`	`3.1.39`

Description

Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on Smarty Security features should upgrade as soon as possible. Please upgrade to 3.1.39 or higher.

NVD description

Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.

References

smarty-php/smarty security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-26119 · ADVISORY
FriendsOfPHP/security-advisories · WEB
smarty-php/smarty · WEB
smarty-php/smarty · WEB
lists.debian.org/debian-lts-announce/2021/04/msg00004.html · WEB
lists.debian.org/debian-lts-announce/2021/04/msg00014.html · WEB
security.gentoo.org/glsa/202105-06 · WEB
srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html · WEB
debian.org/security/2022/dsa-5151 · WEB

More vulnerabilities in smarty/smarty

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

smarty/smarty

Packagist

< 3.1.39

3.1.39

smarty

< 3.1.39

3.1.39

Description

NVD description

Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.

More vulnerabilities in smarty/smarty

See all →