CVE-2026-62992 Smarty: Symlink path traversal out of trusted directories
An attacker can use symbolic links to bypass directory restrictions and read arbitrary files accessible to the PHP process.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62992?
CVE-2026-62992 is a medium-severity path traversal vulnerability in smarty-php smarty, published on 7 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.
Which versions are affected by CVE-2026-62992?
4 open source packages ship an affected version, including smarty/smarty.
| Package | Affected | Fixed in |
|---|---|---|
smarty/smarty Packagist | All versions | 4.5.7 |
smarty/smarty Packagist | All versions | 4.5.7 |
smarty/smarty Packagist | From 5.0.0 | 5.8.2 |
smarty/smarty Packagist | From 5.0.0 | 5.8.2 |
How do I fix CVE-2026-62992?
Upgrade smarty/smarty to a fixed version for your release line: 4.5.7 or 5.8.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-62992 being exploited?
There is no known exploitation of CVE-2026-62992 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-62992, GHSA-f6wf-28g6-769x, UBUNTU-CVE-2026-62992.