CVE-2024-35226: 
PHP vulnerability analysis and mitigation

Smarty, a template engine for PHP that facilitates the separation of presentation (HTML/CSS) from application logic, was found to contain a code injection vulnerability identified as CVE-2024-35226. The vulnerability was discovered and disclosed on May 28, 2024, affecting all versions of Smarty v3.x.x and versions before 4.5.3 and 5.2.0. The vulnerability allows template authors to inject PHP code by manipulating the file name parameter in the extends-tag (GitHub Advisory).

The vulnerability is classified as a PHP code injection flaw (CWE-94) with a CVSS v3.1 base score of 7.3 (High). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is unchanged (S:U) with high impacts on confidentiality (C:H) and integrity (I:H), but no impact on availability (A:N) (NVD).

The vulnerability allows malicious template authors to execute arbitrary PHP code through crafted file names in the extends-tag. This poses a significant security risk for sites that cannot fully trust their template authors, potentially leading to unauthorized code execution and system compromise (GitHub Advisory).

The vulnerability requires low attack complexity and can be exploited by an attacker with low privileges. The attack requires user interaction and can be executed remotely over the network (NVD).

Users are strongly advised to upgrade to Smarty version 4.5.3 or 5.2.0, which contain patches for this vulnerability. For users on the v3 branch, there is no patch available, and no known workarounds exist. Sites that cannot fully trust template authors should update as soon as possible (GitHub Advisory, Ubuntu Notice).