Description

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-10-06T13:16:50.180Z",
  "pubdate": "2026-10-06T13:16:50.180Z",
  "executiveSummary": "Smarty versions before 4.5.8 and 5.x before 5.8.5 are susceptible to a critical code injection vulnerability. The flaw exists within the template inheritance mechanism, specifically when processing 'extends' tags with multi-component inheritance. An attacker can exploit this by supplying maliciously crafted data containing a forged 'SmartyNocache' marker. Because the system fails to correctly restore the 'nocache_hash' during the template regeneration process, the input is treated as trusted code and written directly into the cached PHP file. Successful exploitation allows for arbitrary PHP execution on the server, resulting in complete system compromise, unauthorized data access, and potential remote control of the host application. The risk is considered high due to the lack of required authentication for triggering the vulnerable code path if user-supplied data reaches the template engine.",
  "technicalDetails": "The vulnerability resides in the core template inheritance logic of the Smarty engine, specifically involving the 'extends:' resource handler. The root cause is a state management failure where the 'nocache_hash' variable is improperly handled during the recursive processing of template inheritance chains. In a normal operating state, 'nocache_hash' serves as a unique identifier used to protect dynamic, non-cached sections of a template. However, when complex 'extends' tags are utilized, the engine fails to restore the correct top-level 'nocache_hash', effectively resetting it to a null value during the rendering cycle.\nThis state inconsistency creates a security hole during the creation or regeneration of the PHP cache files. Smarty employs a mechanism to identify non-cached content by injecting specific markers, typically involving 'SmartyNocache' tags, into the compiled PHP output. When the 'nocache_hash' is null or improperly managed, the engine becomes unable to correctly sanitize or escape content passed via template variables that happen to contain these markers.\nThe attack flow begins when an attacker provides input to the application that is subsequently assigned to a Smarty template variable. The attacker crafts the input to include a forged 'SmartyNocache' marker sequence. When the Smarty compiler processes this template, the lack of a proper 'nocache_hash' causes the compiler to mistake the attacker's supplied marker as a legitimate internal non-cached block. Consequently, the compiler performs a verbatim write of the attacker-supplied PHP payload into the generated template cache file.\nUpon the next inclusion of this cached template, the web server executes the resulting PHP file, which now contains the attacker's embedded code. Because this occurs at the PHP execution layer, the injected code runs with the privileges of the web server process. This results in unrestricted Remote Code Execution (RCE). The vulnerability does not require authentication to the Smarty instance itself, provided the application allows arbitrary user input to be passed to vulnerable template inheritance calls. The exploit is persistent as long as the malicious cache file remains on the disk, allowing for recurring execution until the cache is cleared or the underlying template is updated."
}