CVE-2026-62993— Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Quick assessment
Affected
smarty-php smarty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Smarty 是一款用于 PHP 的模板引擎，旨在实现表现层（HTML/CSS）与应用逻辑的分离。在 4.5.7 和 5.8.2 版本之前（视具体发布线而定），Smarty 位于 和 中的 处理逻辑，在启用安全策略时，仅使用 对初始远程 URL 进行校验，以判断其是否属于受信任的 URI 列表。对于由 处理的资源（包括 HTTPS URL），PHP 默认会跟随 HTTP 重定向。因此，如果攻击者能够提供或影响 fetch 的目标，且该目标在一个受信任的主机上存在开放重定向，攻击者便可将请求重定向到其选择的内部端点，
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-62993
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Source: CVE Program / CVE List V5
Vulnerability Description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri() to validate only the initial remote URL against trusted_uri when a security policy was active. For resources handled by file_get_contents(), including HTTPS URLs, PHP followed HTTP redirects by default. An attacker who could supply or influence a fetch target and had an open redirect on a trusted host could redirect the request to an attacker-chosen internal endpoint, bypass the trusted_uri allowlist, and perform server-side request forgery. This issue is fixed in versions 4.5.7 and 5.8.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| smarty-php | smarty | >= 5.0.0, < 5.8.2 | - |
|
II. Public POCs for CVE-2026-62993
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62993
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-62993 (2)
Vendor Pages for CVE-2026-62993 (1)
-
🔗 Release v4.5.7 · smarty-php/smarty · GitHub x_refsource_MISC
Other References for CVE-2026-62993 (3)
-
https://github.com/smarty-php/smarty/pull/1194 x_refsource_MISC
-
https://github.com/smarty-php/smarty/security/advisories/GHSA-cq55-c7wv-pxmq x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: smarty
-
CVE-2026-62996
Smarty Security stream restriction bypass through stream: re -
CVE-2026-62992
Smarty: Symlink path traversal out of trusted directories -
CVE-2024-35226
PHP Code Injection by malicious attribute in extends-tag in -
CVE-2023-28447
Cross site scripting vulnerability in Javascript escaping in -
CVE-2022-29221
PHP Code Injection by malicious block or filename in Smarty
Same vendor: smarty-php
-
CVE-2026-62996
Smarty Security stream restriction bypass through stream: re -
CVE-2026-62992
Smarty: Symlink path traversal out of trusted directories -
CVE-2024-35226
PHP Code Injection by malicious attribute in extends-tag in -
CVE-2023-28447
Cross site scripting vulnerability in Javascript escaping in -
CVE-2022-29221
PHP Code Injection by malicious block or filename in Smarty
Same weakness: CWE-918
-
CVE-2026-77352
Wallos: Authenticated SSRF via per-user SMTP notification ho -
CVE-2026-77351
Wallos: SSRF via Unvalidated User-Level SMTP Host in Email N -
CVE-2026-61640
Wallos: SSRF via OIDC Token/UserInfo URL Configuration -
CVE-2026-61638
Wallos: SSRF via Test Email Notification - unvalidated SMTP -
CVE-2026-82852
WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forg
V. Comments for CVE-2026-62993
No comments yet