CVE-2017-1000480 Smarty PHP code injection

Critical 9.8 Published 3 Jan 2018 Updated 5 Aug 2024

Attackers can execute arbitrary PHP code via unsanitized template names in Smarty's fetch or display functions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-1000480?

CVE-2017-1000480 is a critical code injection vulnerability in n/a, published on 3 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.

Weakness: CWE-94

Which versions are affected by CVE-2017-1000480?

2 open source packages ship an affected version, including smarty/smarty. It affects 1 product.

Package	Affected	Fixed in
`smarty/smarty` Packagist	From `3`	`3.1.32`
`smarty/smarty` Packagist	From `3`	`3.1.32`

Products include Smarty Smarty.

How do I fix CVE-2017-1000480?

Upgrade smarty/smarty to 3.1.32 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2017-1000480 being exploited?

There is no known exploitation of CVE-2017-1000480 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2017-1000480, DLA-1249-1, DSA-4094-1, GHSA-9m49-vhwv-422g, MGASA-2018-0118, UBUNTU-CVE-2017-1000480.