Vulnerability · Published Aug 31, 2026 · Assigned by GitHub_M
CVE-2026-62993Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Medium 6.9
In plain English
A medium-severity server-side request forgery in smarty from smarty-php. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri() to validate only the initial remote URL against trusted_uri when a security policy was active. For resources handled by file_get_contents(), including HTTPS URLs, PHP followed HTTP redirects by default. An attacker who could supply or influence a fetch target and had an open redirect on a trusted host could redirect the request to an attacker-chosen internal endpoint, bypass the trusted_uri allowlist, and perform server-side request forgery. This issue is fixed in versions 4.5.7 and 5.8.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | smarty3 | no fix listed | DEBIAN-CVE-2026-62993 |
| Debian:13 | smarty3 | no fix listed | DEBIAN-CVE-2026-62993 |
| Debian:14 | smarty3 | no fix listed | DEBIAN-CVE-2026-62993 |
| Debian:12 | smarty4 | no fix listed | DEBIAN-CVE-2026-62993 |
| Debian:13 | smarty4 | no fix listed | DEBIAN-CVE-2026-62993 |
| Debian:14 | smarty4 | no fix listed | DEBIAN-CVE-2026-62993 |
| Packagist | smarty/smarty | 5.8.2 | GHSA-cq55-c7wv-pxmq |
| Packagist | smarty/smarty | 4.5.7 | GHSA-cq55-c7wv-pxmq |
| Ubuntu:22.04:LTS | smarty3 | no fix listed | UBUNTU-CVE-2026-62993 |
| Ubuntu:24.04:LTS | smarty3 | no fix listed | UBUNTU-CVE-2026-62993 |
| Ubuntu:26.04:LTS | smarty3 | no fix listed | UBUNTU-CVE-2026-62993 |
| Ubuntu:26.10 | smarty3 | no fix listed | UBUNTU-CVE-2026-62993 |
| Ubuntu:24.04:LTS | smarty4 | no fix listed | UBUNTU-CVE-2026-62993 |
| Ubuntu:26.04:LTS | smarty4 | no fix listed | UBUNTU-CVE-2026-62993 |
| Ubuntu:26.10 | smarty4 | no fix listed | UBUNTU-CVE-2026-62993 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| smarty-php | smarty | >= 5.0.0, < 5.8.2< 4.5.7 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
References
- https://github.com/smarty-php/smarty/security/advisories/GHSA-cq55-c7wv-pxmq x_refsource_CONFIRM
- https://github.com/smarty-php/smarty/pull/1194 x_refsource_MISC
- https://github.com/smarty-php/smarty/commit/31e06fc087a8b5a9b236c1e5dacc1c2850a2c115 x_refsource_MISC
- https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90 x_refsource_MISC
- https://github.com/smarty-php/smarty/releases/tag/v4.5.7 x_refsource_MISC
- https://github.com/smarty-php/smarty/releases/tag/v5.8.2 x_refsource_MISC