CVE-2024-35226

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-352277.5Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed`CVE-2024-352285.5Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.s CVE-2024-352295.3ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern CVE-2024-35238.8A vulnerability classified as critical was found in Campcodes Online Event Management System 1.0. This vulnerability affects unknown code of CVE-2024-352305.3GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the we CVE-2024-352318.6rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5 CVE-2024-352323.7github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. acc CVE-2024-352346.1Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed`CVE-2024-352356.7OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when sta CVE-2024-352364.8Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads CVE-2024-352377.5MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Disc CVE-2024-352385.3Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-se