CVE-2026-62992: Smarty Path Traversal Vulnerability

CVE-2026-62992 Overview

CVE-2026-62992 is a path traversal vulnerability in Smarty, a widely deployed PHP template engine that separates presentation from application logic. The flaw resides in the Security::_checkDir() function, which fails to fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted can point that symlink outside the intended secure directory. This bypasses the containment check and enables arbitrary file read of any file accessible to the PHP process. The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and is fixed in versions 5.8.2 and 4.5.7.

Critical Impact
An attacker with write access to a trusted template or configuration directory can bypass Smarty's security policy containment and read arbitrary files, including credentials, configuration files, and application source code accessible to the PHP process.

Affected Products

Smarty PHP template engine versions prior to 5.8.2 on the 5.x branch
Smarty PHP template engine versions prior to 4.5.7 on the 4.x branch
PHP applications that rely on Smarty's Security policy to sandbox template and config directories

Discovery Timeline

2026-08-07 - CVE-2026-62992 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-62992

Vulnerability Analysis

Smarty's security policy relies on Security::_checkDir() to enforce that any file loaded by the engine resides within a directory the application has explicitly marked as trusted. The check normalizes the requested path as a string using Smarty::_realpath() and then walks up its directory hierarchy looking for a match against the configured secure directories.

The string-level normalization strips components such as .. and ., but it does not consult the filesystem. Symbolic links inside a trusted directory therefore survive the check with their symbolic path intact. When PHP later opens the file, the operating system follows the symlink and returns the contents of whatever the link points to. The result is an arbitrary file read constrained only by the privileges of the PHP process.

Root Cause

The root cause is a canonicalization gap between Smarty's path validator and the underlying filesystem. Smarty::_realpath() performs textual normalization only; it does not call PHP's realpath(), which would resolve symlinks against the filesystem. A symlink placed inside a trusted directory (for example, /var/www/templates/evil.tpl -> /etc/passwd) passes the containment check because its lexical path remains inside the trusted directory.

Attack Vector

Exploitation requires the attacker to place or reference a symbolic link inside a directory Smarty already trusts, such as a template directory, config directory, or cache directory. This typically implies either an authenticated user with upload rights, a co-tenant on shared hosting, or a chained vulnerability that yields limited write access. Once the symlink exists, the attacker requests the linked resource through normal Smarty template or config loading, and Smarty returns the target file's contents.

php

// Security patch in src/Security.php (Smarty 5.8.2)
// Fix: resolve symlinks with realpath() before comparing against trusted dirs
private function _checkDir($filepath, $dirs) {
    // Resolve the canonical, symlink-free path of the requested file so that
    // a symlink located inside a trusted directory cannot be abused to read
    // a file outside of it (CWE-22 path traversal). Smarty::_realpath() only
    // normalizes the path as a string and does not follow symlinks, so we
    // fall back to it only when the file does not yet exist on disk (e.g.
    // config/cache paths that are validated before being written).
    $realpath = @realpath($filepath);
    $resolved = $realpath !== false ? $realpath : $this->smarty->_realpath($filepath, true);
    $directory = dirname($resolved) . DIRECTORY_SEPARATOR;

    // Canonicalize the trusted directories the same way.
    $trusted = [];
    foreach ($dirs as $dir => $unused) {
        $trusted[$dir] = true;
        if (($dirRealpath = @realpath($dir)) !== false) {
            $trusted[rtrim($dirRealpath, '\\/') . DIRECTORY_SEPARATOR] = true;
        }
    }
    // ...
}
// Source: https://github.com/smarty-php/smarty/commit/99c048ce7a590c519b79fbd38ad0143a08183a1f

The patch calls realpath() on both the requested file and the trusted directories, ensuring both sides of the comparison are canonicalized after symlink resolution.

Detection Methods for CVE-2026-62992

Indicators of Compromise

Symbolic links present within Smarty template, config, or cache directories that resolve outside those directories.
Unexpected readlink, symlink, or file creation activity by the PHP process user (for example, www-data) within directories registered as template_dir, config_dir, or secure_dir.
Application logs showing Smarty template or config fetches for filenames that do not correspond to legitimate application assets.
Web access logs containing requests that trigger template or config resource loading followed by responses containing sensitive file contents.

Detection Strategies

Scan filesystem paths registered as Smarty trusted directories for symlinks whose target is outside those directories using find <dir> -type l -lname '*' and validate each result.
Add static analysis rules to identify PHP applications running Smarty versions below 5.8.2 or 4.5.7 in composer manifests and vendored code.
Correlate PHP process file-open events against declared Smarty trusted directories to flag reads of /etc/, private keys, or environment files originating from template rendering flows.

Monitoring Recommendations

Enable filesystem auditing (auditd on Linux) on Smarty template, config, and cache directories to record symlink and symlinkat syscalls.
Alert on PHP-FPM or Apache workers opening files outside the web root shortly after template rendering requests.
Track outbound reads of sensitive files (/etc/passwd, .env, config.php, private key stores) attributed to the web server user.

How to Mitigate CVE-2026-62992

Immediate Actions Required

Upgrade Smarty to version 5.8.2 on the 5.x branch or 4.5.7 on the 4.x branch as soon as possible.
Audit all directories registered with Smarty's Security policy and remove any symbolic links that resolve outside those directories.
Restrict write access to Smarty template, config, and cache directories so that only trusted deployment processes can create files or symlinks there.
Review web server and PHP process privileges to minimize the impact of arbitrary file read on sensitive credentials and keys.

Patch Information

The upstream fix is available in Smarty v5.8.2 and Smarty v4.5.7. The change is implemented in commit 99c048c for the 5.x line and back-ported in commit a1ccdb0 for the 4.x line. Full context is available in the GitHub Security Advisory GHSA-f6wf-28g6-769x.

Workarounds

If patching is not immediately possible, remove write permissions to any directory referenced by Smarty's secure_dir, template_dir, or config_dir for all users other than the deployment account.
Run a scheduled job that enumerates symlinks inside Smarty trusted directories and quarantines any link whose realpath() target falls outside the intended containment root.
Isolate the PHP process using filesystem sandboxing (for example, open_basedir, systemd ProtectHome/ReadOnlyPaths, or containerization) so that arbitrary file reads cannot reach sensitive host files.

bash

# Enumerate symlinks in Smarty trusted directories and flag those
# whose canonical target escapes the intended containment root.
CONTAINMENT_ROOT="/var/www/app/templates"
find "$CONTAINMENT_ROOT" -type l -print0 | while IFS= read -r -d '' link; do
    target=$(readlink -f "$link")
    case "$target" in
        "$CONTAINMENT_ROOT"/*) ;;
        *) echo "UNSAFE symlink: $link -> $target" ;;
    esac
done

# Composer upgrade to the patched releases
composer require smarty/smarty:^5.8.2   # 5.x branch
# or
composer require smarty/smarty:^4.5.7   # 4.x branch