CVE-2022-29221
CVE-2022-29221 · PHP Code Injection by malicious block or filename in Smarty
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
CVSS 8.8 · High · EPSS 4.9% · Fix available
- Published
- Updated
Affected products and versions
smarty
- Versions
- < 3.1.45: Affected
- >= 4.0.0, < 4.1.1: Affected
No fix published
smarty3 Debian:12
- Affected ranges
- ECOSYSTEM: < 3.1.45-1
Update to 3.1.45-1
smarty3 Debian:13
- Affected ranges
- ECOSYSTEM: < 3.1.45-1
Update to 3.1.45-1
smarty3 Debian:14
- Affected ranges
- ECOSYSTEM: < 3.1.45-1
Update to 3.1.45-1
smarty4 Debian:12
- Affected ranges
- ECOSYSTEM: < 4.1.1-1
Update to 4.1.1-1
smarty4 Debian:13
- Affected ranges
- ECOSYSTEM: < 4.1.1-1
Update to 4.1.1-1
smarty4 Debian:14
- Affected ranges
- ECOSYSTEM: < 4.1.1-1
Update to 4.1.1-1
smarty/smarty Packagist
- Versions
- v2.6.24
- v2.6.25
- v2.6.26
- v2.6.27
- v2.6.28
- v2.6.29
- v2.6.30
- v2.6.31
- v2.6.33
- v3.1.11
- v3.1.12
- v3.1.13
- v3.1.14
- v3.1.15
- v3.1.16
- v3.1.17
- v3.1.18
- v3.1.19
- v3.1.20
- v3.1.21
- v3.1.23
- v3.1.24
- v3.1.25
- v3.1.26
- v3.1.27
- v3.1.28
- v3.1.29
- v3.1.30
- v3.1.31
- v3.1.32
- v3.1.33
- v3.1.34
- v3.1.35
- v3.1.36
- v3.1.37
- v3.1.37.1
- v3.1.38
- v3.1.39
- v3.1.40
- v3.1.41
- v3.1.42
- v3.1.43
- v3.1.44
- Affected ranges
- ECOSYSTEM: < 3.1.45
Update to 3.1.45
smarty/smarty Packagist
- Versions
- v4.0.0
- v4.0.1
- v4.0.2
- v4.0.3
- v4.0.4
- v4.1.0
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0, < 4.1.1
Update to 4.1.1
collabtive Ubuntu:16.04:LTS
- Versions
- 2.0+dfsg-6
- 2.0+dfsg-6ubuntu1
- 2.0+dfsg-6ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
galette Ubuntu:16.04:LTS
- Versions
- 0.8+dfsg-1
- 0.8+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gosa Ubuntu:16.04:LTS
- Versions
- 2.7.4+reloaded2-2
- 2.7.4+reloaded2-5
- 2.7.4+reloaded2-6
- 2.7.4+reloaded2-7
- 2.7.4+reloaded2-8
- 2.7.4+reloaded2-9
- 2.7.4+reloaded2-9ubuntu1
- 2.7.4+reloaded2-9ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
smarty3 Ubuntu:Pro:16.04:LTS
- Versions
- 3.1.21-1
- 3.1.21-1ubuntu1
- 3.1.21-1ubuntu1+esm1
- 3.1.21-1ubuntu1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gosa Ubuntu:18.04:LTS
- Versions
- 2.7.4+reloaded2-13ubuntu1
- 2.7.4+reloaded3-2ubuntu1
- 2.7.4+reloaded3-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
postfixadmin Ubuntu:Pro:18.04:LTS
- Versions
- 3.0.2-2
- Affected ranges
- ECOSYSTEM: < 3.0.2-2ubuntu0.1~esm1
Update to 3.0.2-2ubuntu0.1~esm1
smarty3 Ubuntu:Pro:18.04:LTS
- Versions
- 3.1.31+20161214.1.c7d42e4+selfpack1-2
- 3.1.31+20161214.1.c7d42e4+selfpack1-3
- 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1
- 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gosa Ubuntu:20.04:LTS
- Versions
- 2.7.4+reloaded3-10
- 2.7.4+reloaded3-10ubuntu1
- 2.7.4+reloaded3-11
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
postfixadmin Ubuntu:Pro:20.04:LTS
- Versions
- 3.2.1-2
- 3.2.1-3
- Affected ranges
- ECOSYSTEM: < 3.2.1-3ubuntu0.1~esm1
Update to 3.2.1-3ubuntu0.1~esm1
smarty3 Ubuntu:Pro:20.04:LTS
- Versions
- 3.1.33+20180830.1.3a78a21f+selfpack1-1
- 3.1.34+20190228.1.c9f0de05+selfpack1-1
- 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1
- 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1
- 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gosa Ubuntu:22.04:LTS
- Versions
- 2.7.4+reloaded3-16build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
smarty3 Ubuntu:22.04:LTS
- Versions
- 3.1.39-2
- 3.1.39-2ubuntu1
- Affected ranges
- ECOSYSTEM: < 3.1.39-2ubuntu1.22.04.1
Update to 3.1.39-2ubuntu1.22.04.1
postfixadmin Ubuntu:Pro:22.04:LTS
- Versions
- 3.3.7-1
- 3.3.10-2
- Affected ranges
- ECOSYSTEM: < 3.3.10-2ubuntu0.1~esm1
Update to 3.3.10-2ubuntu0.1~esm1
gosa Ubuntu:24.04:LTS
- Versions
- 2.8~git20230203.10abe45+dfsg-8
- 2.8~git20230203.10abe45+dfsg-9
- 2.8~git20230203.10abe45+dfsg-10
- 2.8~git20230203.10abe45+dfsg-11
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gosa Ubuntu:25.10
- Versions
- 2.8~git20230203.10abe45+dfsg-18
- 2.8~git20230203.10abe45+dfsg-19
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c
- https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd
- https://github.com/smarty-php/smarty/releases/tag/v3.1.45
- https://github.com/smarty-php/smarty/releases/tag/v4.1.1
- https://lists.debian.org/debian-lts-announce/2022/05/msg00044.html
- https://www.debian.org/security/2022/dsa-5151
- https://security.gentoo.org/glsa/202209-09
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/
- https://nvd.nist.gov/vuln/detail/CVE-2022-29221