{"id":"CVE-2026-62992","aliases":["GHSA-f6wf-28g6-769x"],"url":"https://o3.security/vulnerability/CVE-2026-62992","summary":"Smarty: Symlink path traversal out of trusted directories","details":"When Smarty's Security policy is enabled, secure_dir (and the configured template/trusted directories) restrict which local files a template may read via {include} and {fetch}. The trust check in Security::_checkDir() resolved the requested path with Smarty::_realpath(), which normalizes the path as a string only and does not follow symbolic links. A symlink placed inside a trusted directory therefore passed the trust check, while the underlying file_get_contents() followed it to an arbitrary file outside the sandbox (e.g. /etc/passwd).\n\n## Impact\nAn attacker able to (a) cause a symlink to exist inside a trusted directory (e.g. a user-upload area located within the template path) and (b) cause a template to reference that path can read arbitrary files readable by the PHP process, escaping the secure_dir boundary. Confidentiality impact only.\n\n## Patches\nFixed in 5.8.2. Security::_checkDir() now resolves the requested file with native realpath() and re-validates the canonical, symlink-free path against the trusted directories (which are canonicalized the same way, so legitimate symlinked deployment paths such as a Capistrano current symlink or macOS /var → /private/var keep working). It falls back to string normalization only when the file does not yet exist on disk.\n\n## Workarounds\nEnsure no untrusted symlinks can be created within any directory listed in secure_dir/the trusted template directories; restrict write access to those directories to trusted processes only.\n\n## References\n- Fix commit: 99c048c\n- CWE-22","published":"2026-08-07T15:02:28.873Z","modified":"2026-10-28T02:31:03.123193325Z","cvss":null,"epss":{"score":0.00364,"percentile":0.29082,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"smarty/smarty","fixedVersion":"5.8.2"},{"ecosystem":"Packagist","name":"smarty/smarty","fixedVersion":"4.5.7"}],"fix":{"url":"https://github.com/smarty-php/smarty/commit/99c048ce7a590c519b79fbd38ad0143a08183a1f","label":"smarty-php/smarty@99c048c"},"references":[{"type":"WEB","url":"https://github.com/smarty-php/smarty/releases/tag/v4.5.7"},{"type":"WEB","url":"https://github.com/smarty-php/smarty/releases/tag/v5.8.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62992.json"},{"type":"ADVISORY","url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-f6wf-28g6-769x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62992"},{"type":"FIX","url":"https://github.com/smarty-php/smarty/commit/99c048ce7a590c519b79fbd38ad0143a08183a1f"},{"type":"FIX","url":"https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90"},{"type":"PACKAGE","url":"https://github.com/smarty-php/smarty"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:03.123193325Z"}}