CVE-2021-26120: 
PHP vulnerability analysis and mitigation

Smarty before version 3.1.39 contains a code injection vulnerability identified as CVE-2021-26120. The vulnerability was discovered in February 2021 and allows code injection via an unexpected function name after a {function name= substring. This vulnerability affects the Smarty template engine for PHP, impacting multiple operating systems including Debian and Ubuntu distributions (NVD, Debian LTS).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited remotely without requiring privileges or user interaction, and can result in high impact to confidentiality, integrity, and availability. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code - 'Code Injection') (NVD).

The vulnerability allows attackers to execute arbitrary code through code injection. When exploited, an attacker can inject malicious code via specially crafted function names in Smarty templates, potentially leading to complete system compromise due to the high impact on confidentiality, integrity, and availability (Debian LTS, NVD).

The vulnerability is considered highly exploitable due to its network-based attack vector and low attack complexity. No special privileges or user interaction are required to exploit this vulnerability, making it particularly dangerous in environments where Smarty is exposed to untrusted input (NVD).

The primary mitigation is to upgrade Smarty to version 3.1.39 or later. Various Linux distributions have released security updates to address this vulnerability: Debian 9 (Stretch) users should upgrade to version 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u2 or later, while Gentoo users should upgrade to version 3.1.39 or later (Debian LTS, Gentoo).