Smarty: Code injection via nocache hash forgery in extends inheritance

Summary

Smarty, a PHP template engine, does not restore the top-level nocache hash when templates use extends: or multi-component inheritance. An attacker who can supply assigned template data containing a forged nocache marker can get arbitrary PHP code written into the regenerated cache file, which is executed on the next include. The vulnerability requires caching, inheritance and request-controlled values echoed unescaped, and the default output is unescaped.

Affected

• Smarty before 4.5.8
• Smarty 5.x before 5.8.5
• Smarty 3.x: unknown, no vendor statement; scanners flag 3.1.39 and the CVE record range starts at 0, so treat it as potentially affected

Fixed in

• Smarty 4.5.8
• Smarty 5.8.5
• Linux distribution packages: unknown, check the status of your distribution

Workaround

Unknown. No vendor workaround is documented; patching is the only confirmed fix.

Exploitation

• Public proof of concept: yes, available on GitHub and exploit aggregators
• Exploited in the wild: no evidence found; not verified against the CISA KEV catalogue
• CISA SSVC: exploitation poc, automatable no, technical impact total

Our recommendation

• Inventory PHP applications that use Smarty, including bundled copies in shop, CMS or web-app software
• Update Smarty to 4.5.8 or 5.8.5, or ask your software provider for the patched version
• After patching, clear the compile and cache directories and check cache files for unexpected PHP code
• Restrict write access to the Smarty compile and cache directories
• Escalate immediately if an affected system is internet-facing

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  murrez/CVE-2026-82531

Research sources

• Fix commit 1cba51c github.com
• Fix commit c0fdd48 github.com
• Smarty release 4.5.8 github.com
• Smarty release 5.8.5 github.com
• GitHub Security Advisory GHSA-3w63-v7pm-cq9x github.com
• VulnCheck advisory www.vulncheck.com
• Public PoC on GitHub github.com
• Ubuntu security tracker ubuntu.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:52.