Smarty Template Engine Vulnerability Allows Remote Code Execution
A security flaw in Smarty's cache handling allows attackers to escalate Cross-Site Scripting into Remote Code Execution via the {extends} tag.
Smarty contains a security vulnerability where an attacker can escalate a Cross-Site Scripting flaw into Remote Code Execution. This specific issue happens when you use the {extends} tag inside cached templates, which can let unauthorized code run on the server.
The bug stems from cache handling during compilation. When templates that use inheritance get cached, the engine misses proper sanitization or isolation for certain inputs. If malicious script enters a context that gets cached, the resulting file might contain executable PHP code instead of safe HTML.
Applications letting user input affect template structure or content are at risk. You need to review template caching implementation and {extends} tag usage.
Make sure user input is never processed directly by the template engine to defend against this injection. Maintainers released patches fixing the logic error that causes the transition from XSS to RCE, so updating to the latest release of the library is recommended.