CVE-2026-82531

Description officielle (NVD)

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Preuves de concept publiques (1)

Dépôts tiers non vérifiés, parfois piégés. Ne les exécutez jamais en production : uniquement dans un environnement de test isolé.

• murrez/CVE-2026-82531 · ★ 1 · 07/10/2026
  Smarty is vulnerable to code injection through template inheritance. Crafted assigned data can inject a forged SmartyNocache marker into regenerated PHP cache files, potentially allowing attackers to

Références

• https://github.com/smarty-php/smarty/commit/1cba51cb813563eb61d963c83d28cd59f26b858d
• https://github.com/smarty-php/smarty/commit/c0fdd4824aca4f67e814b50703cfee1dfde41414
• https://github.com/smarty-php/smarty/releases/tag/v4.5.8
• https://github.com/smarty-php/smarty/releases/tag/v5.8.5
• https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x
• https://www.vulncheck.com/advisories/smarty-before-4.5.8-and-5-x-before-5.8.5-php-code-injection-via-extends-i...
• https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x

En bref

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS : probabilité estimée d'exploitation dans les 30 prochains jours.

Sources officielles

Besoin d'aide ?

Nos experts évaluent votre exposition et vous accompagnent dans la correction.