What is GHSA-4rmg-292m-wg3w?

GHSA-4rmg-292m-wg3w is a security advisory published by GitHub Security Advisories with High severity. Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag

Which CVE IDs does GHSA-4rmg-292m-wg3w cover?

GHSA-4rmg-292m-wg3w covers the following CVE IDs: CVE-2024-35226. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4rmg-292m-wg3w?

GHSA-4rmg-292m-wg3w has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

Which products are affected by GHSA-4rmg-292m-wg3w?

GHSA-4rmg-292m-wg3w affects 2 products, including: composer/smarty/smarty:\u003e= 5.0.0, \u003c 5.1.1; composer/smarty/smarty:\u003e= 3.0.0, \u003c 4.5.3.

GHSA-4rmg-292m-wg3wHighCVSS 7.3

Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag

Vendor

GitHub Security Advisories

Published

May 29, 2024

Last Modified

November 4, 2025

🔗 CVE IDs covered (1)

CVE-2024-35226 →

📋 Description

Impact

Template authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.

Patches

Please upgrade to the most recent version of Smarty v4 or v5. There is no patch for v3.

🎯 Affected products2

composer/smarty/smarty:>= 5.0.0, < 5.1.1
composer/smarty/smarty:>= 3.0.0, < 4.5.3

🔗 References (5)

https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w
https://nvd.nist.gov/vuln/detail/CVE-2024-35226
https://github.com/smarty-php/smarty/commit/0be92bc8a6fb83e6e0d883946f7e7c09ba4e857a
https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html
https://github.com/advisories/GHSA-4rmg-292m-wg3w