Sandbox escape through template_object in smarty

概要

参考情報

• smarty-php/smarty security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2021-26119 · ADVISORY
• FriendsOfPHP/security-advisories · WEB
• smarty-php/smarty · WEB
• smarty-php/smarty · WEB
• lists.debian.org/debian-lts-announce/2021/04/msg00004.html · WEB
• lists.debian.org/debian-lts-announce/2021/04/msg00014.html · WEB
• security.gentoo.org/glsa/202105-06 · WEB
• srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html · WEB
• debian.org/security/2022/dsa-5151 · WEB

smarty/smarty のその他の脆弱性

• CVE-2026-62993中 6.9Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2…
• CVE-2026-62996中 6.9Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, …
• CVE-2026-62992中 6.9Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.…
• CVE-2024-35226高 7.3Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions tem…
• CVE-2023-28447中 6.1Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vul…