{
  "cveId": "CVE-2018-25047",
  "url": "https://patchblox.com/security/cve/CVE-2018-25047",
  "summary": "CVE-2018-25047 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2018-25047, released September 15, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "smarty3: In Smarty before 3.1.47 and 4.x before 4.2.1,libs/plugins/function.mailto.php allows XSS",
  "description": "In Smarty before 3.1.47 and 4.x before 4.2.1,libs/plugins/function.mailto.php allows XSS. A web page that usessmarty_function_mailto, and that could be parameterized using GET or POSTinput parameters, could allow injection of JavaScript code by a user.",
  "published": "2022-09-14T17:15:00Z",
  "severity": "Medium",
  "cvss": 5.4,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.011,
  "epssPercentile": 0.65863,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "3.1.39-2\u002Bdeb11u2",
      "fix": "DLA-3956-1",
      "url": "https://patchblox.com/security/fix/linux/dla-3956-1",
      "released": "2024-11-17T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.1.47-1",
      "fix": "DEBIAN-CVE-2018-25047",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2018-25047",
      "released": "2022-09-15T00:15:09Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.1.47-1",
      "fix": "DEBIAN-CVE-2018-25047",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2018-25047",
      "released": "2022-09-15T00:15:09Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Debian 14",
      "fixedVersion": "3.1.47-1",
      "fix": "DEBIAN-CVE-2018-25047",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2018-25047",
      "released": "2022-09-15T00:15:09Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "3.1.31\u002B20161214.1.c7d42e4\u002Bselfpack1-3ubuntu0.1\u002Besm1",
      "fix": "smarty3 3.1.31\u002B20161214.1.c7d42e4\u002Bselfpack1-3ubuntu0.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-smarty3-3.1.31-20161214.1.c7d42e4-selfpack1-3ubuntu0.1-esm1",
      "released": "2024-05-28T14:16:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "3.1.34\u002B20190228.1.c9f0de05\u002Bselfpack1-1ubuntu0.1",
      "fix": "smarty3 3.1.34\u002B20190228.1.c9f0de05\u002Bselfpack1-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-smarty3-3.1.34-20190228.1.c9f0de05-selfpack1-1ubuntu0.1",
      "released": "2024-05-28T14:16:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.1.39-2ubuntu1.22.04.2",
      "fix": "smarty3 3.1.39-2ubuntu1.22.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-smarty3-3.1.39-2ubuntu1.22.04.2",
      "released": "2024-05-28T14:16:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.1.48-1ubuntu0.24.04.1",
      "fix": "smarty3 3.1.48-1ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-smarty3-3.1.48-1ubuntu0.24.04.1",
      "released": "2024-05-28T14:16:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3.1.48-1ubuntu0.24.10.1",
      "fix": "smarty3 3.1.48-1ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-smarty3-3.1.48-1ubuntu0.24.10.1",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "smarty4",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "4.2.1-1",
      "fix": "DEBIAN-CVE-2018-25047",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2018-25047",
      "released": "2022-09-15T00:15:09Z"
    },
    {
      "platform": "linux",
      "product": "smarty4",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "4.2.1-1",
      "fix": "DEBIAN-CVE-2018-25047",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2018-25047",
      "released": "2022-09-15T00:15:09Z"
    },
    {
      "platform": "linux",
      "product": "smarty4",
      "release": "Debian 14",
      "fixedVersion": "4.2.1-1",
      "fix": "DEBIAN-CVE-2018-25047",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2018-25047",
      "released": "2022-09-15T00:15:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}