Server-Side Request Forgery Vulnerability in Smarty Template Engine
CVE-2026-62993
6.9MEDIUM
What is CVE-2026-62993?
The Smarty Template Engine, a popular PHP tool for separating presentation from application logic, has a vulnerability in its {fetch} handling system. Prior versions up to 4.5.7 and 5.8.2 allow an attacker to exploit open redirects on trusted hosts to perform Server-Side Request Forgery (SSRF). This loophole arises from insufficient validation of the fetch target, enabling unauthorized redirection requests through file_get_contents() which adheres to default PHP redirection rules. Consequently, users are urged to update to the latest versions to mitigate this risk.
Affected Version(s)
smarty >= 5.0.0, < 5.8.2 < 5.0.0, 5.8.2
smarty < 4.5.7 < 4.5.7