CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource
An attacker can read arbitrary local files by exploiting insufficient stream wrapper restrictions in the Smarty PHP template engine.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62996?
CVE-2026-62996 is a medium-severity path traversal vulnerability in smarty-php smarty, published on 7 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents outside the intended template/config scope. This issue is fixed in version 5.8.4.
Weakness: CWE-22
Which versions are affected by CVE-2026-62996?
2 open source packages ship an affected version, including smarty/smarty.
| Package | Affected | Fixed in |
|---|---|---|
smarty/smarty Packagist | From 5.0.0 | 5.8.4 |
smarty/smarty Packagist | From 5.0.0 | 5.8.4 |
How do I fix CVE-2026-62996?
Upgrade smarty/smarty to 5.8.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-62996 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62996 exists.
Sources
Also known as GHSA-rjhh-76wf-8xmw, UBUNTU-CVE-2026-62996.