{
  "cveId": "CVE-2024-35226",
  "url": "https://patchblox.com/security/cve/CVE-2024-35226",
  "summary": "CVE-2024-35226 is fixed in 2 products on 1 platform, first by smarty3 3.1.31\u002B20161214.1.c7d42e4\u002Bselfpack1-3ubuntu0.1\u002Besm1, released May 28, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "smarty3: Smarty is a template engine for PHP, facilitating the separation ofpresentation (HTML/CSS) from application logic",
  "description": "Smarty is a template engine for PHP, facilitating the separation ofpresentation (HTML/CSS) from application logic. In affected versionstemplate authors could inject php code by choosing a malicious file namefor an extends-tag. Sites that cannot fully trust template authors shouldupdate asap. All users are advised to update. There is no patch for userson the v3 branch. There are no known workarounds for this vulnerability.",
  "published": "2024-05-28T14:16:00Z",
  "severity": "Medium",
  "cvss": 7.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
  "epss": 0.00507,
  "epssPercentile": 0.43561,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.1.47-2\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2024-35226",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-35226",
      "released": "2024-05-28T21:16:30Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.1.48-2",
      "fix": "DEBIAN-CVE-2024-35226",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-35226",
      "released": "2024-05-28T21:16:30Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Debian 14",
      "fixedVersion": "3.1.48-2",
      "fix": "DEBIAN-CVE-2024-35226",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-35226",
      "released": "2024-05-28T21:16:30Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "3.1.31\u002B20161214.1.c7d42e4\u002Bselfpack1-3ubuntu0.1\u002Besm1",
      "fix": "smarty3 3.1.31\u002B20161214.1.c7d42e4\u002Bselfpack1-3ubuntu0.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-smarty3-3.1.31-20161214.1.c7d42e4-selfpack1-3ubuntu0.1-esm1",
      "released": "2024-05-28T14:16:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "3.1.34\u002B20190228.1.c9f0de05\u002Bselfpack1-1ubuntu0.1",
      "fix": "smarty3 3.1.34\u002B20190228.1.c9f0de05\u002Bselfpack1-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-smarty3-3.1.34-20190228.1.c9f0de05-selfpack1-1ubuntu0.1",
      "released": "2024-05-28T14:16:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.1.39-2ubuntu1.22.04.2",
      "fix": "smarty3 3.1.39-2ubuntu1.22.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-smarty3-3.1.39-2ubuntu1.22.04.2",
      "released": "2024-05-28T14:16:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.1.48-1ubuntu0.24.04.1",
      "fix": "smarty3 3.1.48-1ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-smarty3-3.1.48-1ubuntu0.24.04.1",
      "released": "2024-05-28T14:16:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty3",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3.1.48-1ubuntu0.24.10.1",
      "fix": "smarty3 3.1.48-1ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-smarty3-3.1.48-1ubuntu0.24.10.1",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "smarty4",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "4.3.0-1\u002Bdeb12u2",
      "fix": "DSA-5830-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5830-1",
      "released": "2024-12-12T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty4",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "4.5.4-1",
      "fix": "DEBIAN-CVE-2024-35226",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-35226",
      "released": "2024-05-28T21:16:30Z"
    },
    {
      "platform": "linux",
      "product": "smarty4",
      "release": "Debian 14",
      "fixedVersion": "4.5.4-1",
      "fix": "DEBIAN-CVE-2024-35226",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-35226",
      "released": "2024-05-28T21:16:30Z"
    },
    {
      "platform": "linux",
      "product": "smarty4",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "4.3.1-1ubuntu0.24.04.1",
      "fix": "smarty4 4.3.1-1ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-smarty4-4.3.1-1ubuntu0.24.04.1",
      "released": "2024-05-28T14:16:00Z"
    },
    {
      "platform": "linux",
      "product": "smarty4",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "4.3.1-1ubuntu0.24.10.1",
      "fix": "smarty4 4.3.1-1ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-smarty4-4.3.1-1ubuntu0.24.10.1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}