CVE-2026-62993 — smarty
Fix: smarty-php/smarty@31e06fcCVE-2026-62993 is a Server-Side Request Forgery (SSRF) vulnerability in smarty/smarty. A fix is available for smarty/smarty — see the affected versions and patch details below.
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-62993.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
smarty/smarty🐘smarty/smartyReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
When a Security policy is active, {fetch} validates the requested remote URL against the trusted_uri allowlist via Security::isTrustedUri(). For non-http:// schemes (e.g. https://) the resource was then read with file_get_contents(), which follows HTTP redirects by default. Because isTrustedUri() only validates the initial URL, an open redirect on an otherwise-trusted host could be used to redirect the request to a non-trusted, internal target — bypassing the trusted_uri policy.
Impact
An attacker who can supply a fetch target (or influence one) and who has an open redirect available on a trusted host can cause the server to issue requests to attacker-chosen internal endpoints, defeating the trusted_uri allowlist (server-side request forgery).
Patches
Fixed in 5.8.2. When a security policy is active, {fetch} now passes a stream context that disables redirect following (follow_location => 0, max_redirects => 1) to file_get_contents() for remote resources. Behavior is unchanged when no security policy is set, since there is no trusted_uri to bypass.
Workarounds
Avoid fetching remote resources from within templates under untrusted control; ensure hosts listed in trusted_uri do not expose open redirects.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | smarty/smarty | ≥ 5.0.0&&< 5.8.2 | 5.8.2composer require smarty/smarty:^5.8.2 |
| 🐘Packagist | smarty/smarty | all versions | 4.5.7composer require smarty/smarty:^4.5.7 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for smarty/smarty, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update smarty/smarty to 5.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-62993 is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Frequently Asked Questions
Is CVE-2026-62993 in your dependencies?
Find it across Packagist, including transitive dependencies.