CVE-2026-82531— Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
Quick assessment
Affected
smarty-php smarty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Smarty 4.5.8 之前版本以及 5.x 中早于 5.8.5 的版本中，存在一个代码注入漏洞。该漏洞发生在 extends:/多组件模板继承机制中，顶级 nocache_hash 变量在继承过程中从未被恢复，导致其值为空（null）。攻击者可以构造包含伪造的 SmartyNocache 标记的赋值数据，该标记会被原样复制并写入重新生成的 PHP 缓存文件中。当缓存文件被包含（include）时，将执行任意 PHP 代码，从而导致远程代码执行（RCE）。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82531
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
Source: CVE Program / CVE List V5
Vulnerability Description
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| smarty-php | smarty | 0 ~ 4.5.8 | - |
|
II. Public POCs for CVE-2026-82531
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82531
请登录查看更多情报信息。
Other References for CVE-2026-82531 (6)
-
https://github.com/smarty-php/smarty/releases/tag/v4.5.8 release-notes
-
https://github.com/smarty-php/smarty/releases/tag/v5.8.5 release-notes
IV. Related Vulnerabilities
Same product: smarty
-
CVE-2026-62993
Smarty: SSRF via redirect bypass of trusted_uri using {fetch -
CVE-2026-62996
Smarty Security stream restriction bypass through stream: re -
CVE-2026-62992
Smarty: Symlink path traversal out of trusted directories -
CVE-2024-35226
PHP Code Injection by malicious attribute in extends-tag in -
CVE-2023-28447
Cross site scripting vulnerability in Javascript escaping in
Same vendor: smarty-php
-
CVE-2026-62993
Smarty: SSRF via redirect bypass of trusted_uri using {fetch -
CVE-2026-62996
Smarty Security stream restriction bypass through stream: re -
CVE-2026-62992
Smarty: Symlink path traversal out of trusted directories -
CVE-2024-35226
PHP Code Injection by malicious attribute in extends-tag in -
CVE-2023-28447
Cross site scripting vulnerability in Javascript escaping in
Same weakness: CWE-94
-
CVE-2026-105796
Kiota: Code injection through doc-comment delimiter reformat -
CVE-2026-39776
WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) v -
CVE-2026-39725
WordPress Content Visibility for Divi Builder plugin <= 5.03 -
CVE-2026-32568
WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote -
CVE-2026-105764
Immich: Authenticated SVG upload reaches ImageMagick coders
V. Comments for CVE-2026-82531
No comments yet