CVE-2026-62993 Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Attackers can bypass trusted URI restrictions in Smarty's fetch function via open redirects, enabling server-side request forgery to access internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62993?
CVE-2026-62993 is a medium-severity server-side request forgery vulnerability in smarty-php smarty, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri() to validate only the initial remote URL against trusted_uri when a security policy was active. For resources handled by file_get_contents(), including HTTPS URLs, PHP followed HTTP redirects by default. An attacker who could supply or influence a fetch target and had an open redirect on a trusted host could redirect the request to an attacker-chosen internal endpoint, bypass the trusted_uri allowlist, and perform server-side request forgery. This issue is fixed in versions 4.5.7 and 5.8.2.
Weakness: CWE-918
Which versions are affected by CVE-2026-62993?
4 open source packages ship an affected version, including smarty/smarty.
| Package | Affected | Fixed in |
|---|---|---|
smarty/smarty Packagist | All versions | 4.5.7 |
smarty/smarty Packagist | All versions | 4.5.7 |
smarty/smarty Packagist | From 5.0.0 | 5.8.2 |
smarty/smarty Packagist | From 5.0.0 | 5.8.2 |
How do I fix CVE-2026-62993?
Upgrade smarty/smarty to a fixed version for your release line: 4.5.7 or 5.8.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-62993 being exploited?
There is no known exploitation of CVE-2026-62993 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-62993, GHSA-cq55-c7wv-pxmq, UBUNTU-CVE-2026-62993.