Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d5fc9dcdd7 advisory.

    ## [3.1.47] - 2022-09-14

    ### Security
    - Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks     [#454](https://github.com/smarty-php/smarty/issues/454)

    ### Fixed
    - Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-     php/smarty/issues/794)
    - Fixed unselected year/month/day not working in html_select_date [#395](https://github.com/smarty-     php/smarty/issues/395)

    ## [3.1.46] - 2022-08-01

    ### Fixed
    - Fixed problems with smarty_mb_str_replace [#549](https://github.com/smarty-php/smarty/issues/549)
    - Fixed second parameter of unescape modifier not working [#777](https://github.com/smarty-     php/smarty/issues/777)

    ## [3.1.45] - 2022-05-17

    ### Security
    - Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221

    ### Fixed
    - Math equation `max(x, y)` didn't work anymore [#721](https://github.com/smarty-php/smarty/issues/721)

    ## [3.1.44] - 2022-01-18

    ### Fixed
    - Fixed illegal characters bug in math function security check [#702](https://github.com/smarty-     php/smarty/issues/702)

    ## [3.1.43] - 2022-01-10

    ### Security
    - Prevent evasion of the `static_classes` security policy. This addresses CVE-2021-21408

    ## [3.1.42] - 2022-01-10

    ### Security
    - Prevent arbitrary PHP code execution through maliciously crafted expression for the math function. This     addresses CVE-2021-29454

    ## [3.1.41] - 2022-01-09

    ### Security
    - Rewrote the mailto function to not use `eval` when encoding with javascript

    ## [3.1.40] - 2021-10-13

    ### Changed
    - modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used     https://github.com/smarty-php/smarty/pull/649

    ### Security
    - More advanced javascript escaping to handle     https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements thanks     to m-haritonov

    ## [3.1.39] - 2021-02-17

    ### Security
    - Prevent access to `$smarty.template_object` in sandbox mode. This addresses CVE-2021-26119.
    - Fixed code injection vulnerability by using illegal function names in `{function     name='blah'}{/function}`. This addresses CVE-2021-26120.

    ## [3.1.38] - 2021-01-08

    ### Fixed
    - Smarty::SMARTY_VERSION wasn't updated https://github.com/smarty-php/smarty/issues/628

    ## [3.1.37] - 2021-01-07

    ### Changed
    - Changed error handlers and handling of undefined constants for php8-compatibility (set $errcontext     argument optional) https://github.com/smarty-php/smarty/issues/605
    - Changed expected error levels in unit tests for php8-compatibility
    - Travis unit tests now run for all php versions >= 5.3, including php8
    - Travis runs on Xenial where possible

    ### Fixed
    - PHP5.3 compatibility fixes
    - Brought lexer source functionally up-to-date with compiled version

    ## [3.1.36] - 2020-04-14

    ### Fixed
     - Smarty::SMARTY_VERSION wasn't updated in v3.1.35 https://github.com/smarty-php/smarty/issues/584

    ## [3.1.35] - 2020-04-14
     - remove whitespaces after comments https://github.com/smarty-php/smarty/issues/447
     - fix foreachelse on arrayiterators https://github.com/smarty-php/smarty/issues/506
     - fix files contained in git export archive for package maintainers https://github.com/smarty-     php/smarty/issues/325
     - throw SmartyException when setting caching attributes for cacheable plugin https://github.com/smarty-     php/smarty/issues/457
     - fix errors that occured where isset was replaced with null check such as https://github.com/smarty-     php/smarty/issues/453
     - unit tests are now in the repository

    ## 3.1.34 release - 05.11.2019     13.01.2020
     - fix typo in exception message (JercSi)
     - fix typehint warning with callable (bets4breakfast)
     - add travis badge and compatability info to readme (matks)
     - fix stdClass cast when compiling foreach (carpii)
     - fix wrong set/get methods for memcached (IT-Experte)
     - fix pborm assigning value to object variables in smarty_internal_compile_assign (Hunman)
     - exclude error_reporting.ini from git export (glensc)

    ## 3.1.34-dev-6 -     30.10.2018
     - bugfix a nested subblock in an inheritance child template was not replace by        outer level block with same name in same child template https://github.com/smarty-php/smarty/issues/500

    29.10.2018
     - bugfix Smarty::$php_handling == PHP_PASSTHRU (default) did eat the \n (newline) character if it did     directly followed        a PHP tag like ?> or other https://github.com/smarty-php/smarty/issues/501

    14.10.2018
     - bugfix autoloader exit shortcut https://github.com/smarty-php/smarty/issues/467

    11.10.2018
     - bugfix {insert} not works when caching is enabled and included template is present        https://github.com/smarty-php/smarty/issues/496
     - bugfix in date-format modifier; NULL at date string or default_date did not produce correct output        https://github.com/smarty-php/smarty/pull/458

    09.10.2018
     - bugfix fix of 26.8.2017 https://github.com/smarty-php/smarty/issues/327        modifier is applied to sum expression https://github.com/smarty-php/smarty/issues/491
     - bugfix indexed arrays could not be defined array(...)

    18.09.2018
      - bugfix large plain text template sections without a Smarty tag > 700kB could         could fail in version 3.1.32 and 3.1.33 because PHP preg_match() restrictions         https://github.com/smarty-php/smarty/issues/488

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6550-1 advisory.

    It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing     user input when generating templates. An attacker could, through PHP injection, possibly use this issue to     execute arbitrary code. (CVE-2022-29221)

    It was discovered that Moment.js, that is integrated in the PostfixAdmin code, was using an inefficient     parsing algorithm when processing date strings in the RFC 2822 standard. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-31129)

    It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly escaping     JavaScript code. An attacker could possibly use this issue to conduct cross-site scripting attacks (XSS).
    (CVE-2023-28447)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6012-1 advisory.

    It was discovered that Smarty incorrectly parsed blocks' names and included files' names. A remote     attacker with template writing permissions could use this issue to execute arbitrary PHP code.
    (CVE-2022-29221)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-52154efd61 advisory.

    ## [3.1.47] - 2022-09-14

    ### Security
    - Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks     [#454](https://github.com/smarty-php/smarty/issues/454)

    ### Fixed
    - Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-     php/smarty/issues/794)
    - Fixed unselected year/month/day not working in html_select_date [#395](https://github.com/smarty-     php/smarty/issues/395)

    ## [3.1.46] - 2022-08-01

    ### Fixed
    - Fixed problems with smarty_mb_str_replace [#549](https://github.com/smarty-php/smarty/issues/549)
    - Fixed second parameter of unescape modifier not working [#777](https://github.com/smarty-     php/smarty/issues/777)

    ## [3.1.45] - 2022-05-17

    ### Security
    - Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221

    ### Fixed
    - Math equation `max(x, y)` didn't work anymore [#721](https://github.com/smarty-php/smarty/issues/721)

    ## [3.1.44] - 2022-01-18

    ### Fixed
    - Fixed illegal characters bug in math function security check [#702](https://github.com/smarty-     php/smarty/issues/702)

    ## [3.1.43] - 2022-01-10

    ### Security
    - Prevent evasion of the `static_classes` security policy. This addresses CVE-2021-21408

    ## [3.1.42] - 2022-01-10

    ### Security
    - Prevent arbitrary PHP code execution through maliciously crafted expression for the math function. This     addresses CVE-2021-29454

    ## [3.1.41] - 2022-01-09

    ### Security
    - Rewrote the mailto function to not use `eval` when encoding with javascript

    ## [3.1.40] - 2021-10-13

    ### Changed
    - modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used     https://github.com/smarty-php/smarty/pull/649

    ### Security
    - More advanced javascript escaping to handle     https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements thanks     to m-haritonov

    ## [3.1.39] - 2021-02-17

    ### Security
    - Prevent access to `$smarty.template_object` in sandbox mode. This addresses CVE-2021-26119.
    - Fixed code injection vulnerability by using illegal function names in `{function     name='blah'}{/function}`. This addresses CVE-2021-26120.

    ## [3.1.38] - 2021-01-08

    ### Fixed
    - Smarty::SMARTY_VERSION wasn't updated https://github.com/smarty-php/smarty/issues/628

    ## [3.1.37] - 2021-01-07

    ### Changed
    - Changed error handlers and handling of undefined constants for php8-compatibility (set $errcontext     argument optional) https://github.com/smarty-php/smarty/issues/605
    - Changed expected error levels in unit tests for php8-compatibility
    - Travis unit tests now run for all php versions >= 5.3, including php8
    - Travis runs on Xenial where possible

    ### Fixed
    - PHP5.3 compatibility fixes
    - Brought lexer source functionally up-to-date with compiled version

    ## [3.1.36] - 2020-04-14

    ### Fixed
     - Smarty::SMARTY_VERSION wasn't updated in v3.1.35 https://github.com/smarty-php/smarty/issues/584

    ## [3.1.35] - 2020-04-14
     - remove whitespaces after comments https://github.com/smarty-php/smarty/issues/447
     - fix foreachelse on arrayiterators https://github.com/smarty-php/smarty/issues/506
     - fix files contained in git export archive for package maintainers https://github.com/smarty-     php/smarty/issues/325
     - throw SmartyException when setting caching attributes for cacheable plugin https://github.com/smarty-     php/smarty/issues/457
     - fix errors that occured where isset was replaced with null check such as https://github.com/smarty-     php/smarty/issues/453
     - unit tests are now in the repository

    ## 3.1.34 release - 05.11.2019     13.01.2020
     - fix typo in exception message (JercSi)
     - fix typehint warning with callable (bets4breakfast)
     - add travis badge and compatability info to readme (matks)
     - fix stdClass cast when compiling foreach (carpii)
     - fix wrong set/get methods for memcached (IT-Experte)
     - fix pborm assigning value to object variables in smarty_internal_compile_assign (Hunman)
     - exclude error_reporting.ini from git export (glensc)

    ## 3.1.34-dev-6 -     30.10.2018
     - bugfix a nested subblock in an inheritance child template was not replace by        outer level block with same name in same child template https://github.com/smarty-php/smarty/issues/500

    29.10.2018
     - bugfix Smarty::$php_handling == PHP_PASSTHRU (default) did eat the \n (newline) character if it did     directly followed        a PHP tag like ?> or other https://github.com/smarty-php/smarty/issues/501

    14.10.2018
     - bugfix autoloader exit shortcut https://github.com/smarty-php/smarty/issues/467

    11.10.2018
     - bugfix {insert} not works when caching is enabled and included template is present        https://github.com/smarty-php/smarty/issues/496
     - bugfix in date-format modifier; NULL at date string or default_date did not produce correct output        https://github.com/smarty-php/smarty/pull/458

    09.10.2018
     - bugfix fix of 26.8.2017 https://github.com/smarty-php/smarty/issues/327        modifier is applied to sum expression https://github.com/smarty-php/smarty/issues/491
     - bugfix indexed arrays could not be defined array(...)

    18.09.2018
      - bugfix large plain text template sections without a Smarty tag > 700kB could         could fail in version 3.1.32 and 3.1.33 because PHP preg_match() restrictions         https://github.com/smarty-php/smarty/issues/488

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202209-09 (Smarty: Multiple vulnerabilities)

  - In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that     uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could     allow injection of JavaScript code by a user. (CVE-2018-25047)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php     methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. (CVE-2021-21408)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by     crafting a malicious math string. If a math string was passed through as user provided data to the math     function, external users could run arbitrary PHP code by crafting a malicious math string. Users should     upgrade to version 3.1.42 or 4.0.2 to receive a patch. (CVE-2021-29454)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing     a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should     upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known     workarounds. (CVE-2022-29221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-3033 advisory.

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing     a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should     upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known     workarounds. (CVE-2022-29221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5151 advisory.

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php     methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. (CVE-2021-21408)

  - Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox     mode. (CVE-2021-26119)

  - Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name=     substring. (CVE-2021-26120)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by     crafting a malicious math string. If a math string was passed through as user provided data to the math     function, external users could run arbitrary PHP code by crafting a malicious math string. Users should     upgrade to version 3.1.42 or 4.0.2 to receive a patch. (CVE-2021-29454)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing     a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should     upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known     workarounds. (CVE-2022-29221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211188	Fedora 37 : php-Smarty (2022-d5fc9dcdd7)	Nessus	Fedora Local Security Checks	critical
186757	Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : PostfixAdmin vulnerabilities (USN-6550-1)	Nessus	Ubuntu Local Security Checks	high
174230	Ubuntu 22.04 LTS : Smarty vulnerability (USN-6012-1)	Nessus	Ubuntu Local Security Checks	high
169147	Fedora 36 : php-Smarty (2022-52154efd61)	Nessus	Fedora Local Security Checks	critical
165442	GLSA-202209-09 : Smarty: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
161688	Debian DLA-3033-1 : smarty3 - LTS security update	Nessus	Debian Local Security Checks	high
161686	Debian DSA-5151-1 : smarty3 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-29221

high

Tenable Plugins

critical

high

high

critical

high

high

critical