p PatchFirst

CVE-2014-8350

CVE-2014-8350

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.

EPSS 3.1% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • smarty3 Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.1.21-1

    Update to 3.1.21-1

  • smarty3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.1.21-1

    Update to 3.1.21-1

  • smarty3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.1.21-1

    Update to 3.1.21-1

  • smarty/smarty Packagist

    Versions
    • v2.6.24
    • v2.6.25
    • v2.6.26
    • v2.6.27
    • v2.6.28
    • v2.6.29
    • v2.6.30
    • v2.6.31
    • v2.6.33
    • v3.1.11
    • v3.1.12
    • v3.1.13
    • v3.1.14
    • v3.1.15
    • v3.1.16
    • v3.1.17
    • v3.1.18
    • v3.1.19
    • v3.1.20
    Affected ranges
    • ECOSYSTEM: < 3.1.21

    Update to 3.1.21

Original sources

Check your server →