CVE-2026-62992: 
PHP vulnerability analysis and mitigation

CVE-2026-62992 is a symlink path traversal vulnerability in the Smarty PHP template engine that allows an attacker to read arbitrary files outside of configured secure directories. The flaw exists in Security::_checkDir(), which used Smarty::_realpath() for path validation — a function that normalizes paths as strings only and does not resolve symbolic links. Affected versions include Smarty 5.x before 5.8.2 and all 4.x versions before 4.5.7. The vulnerability was disclosed on August 7, 2026, with patches released simultaneously. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is improper link resolution before file access (CWE-59 / CWE-61), which enables a path traversal condition (CWE-22). When Smarty's Security policy is active, Security::_checkDir() validated file paths using Smarty::_realpath(), which performs only string-based normalization and never follows symbolic links. As a result, a symlink placed inside a trusted secure_dir or template directory would pass the trust check, while the underlying file_get_contents() call would follow the symlink to an arbitrary file outside the sandbox (e.g., /etc/passwd). Exploitation requires the attacker to (a) place or cause a symlink to exist inside a trusted directory — such as a user-upload area within the template path — and (b) cause a Smarty template to reference that symlink path via {include} or {fetch} (GitHub Advisory, Fix Commit).

Successful exploitation results in unauthorized read access to arbitrary files accessible by the PHP process, limited to confidentiality impact (no integrity or availability impact). An attacker could read sensitive files such as /etc/passwd, application configuration files containing credentials, private keys, or other data outside the intended template sandbox. The impact is scoped to the permissions of the PHP process user, but in many web server deployments this can expose significant application secrets (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment indicates exploitation is currently "none." The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires elevated privileges (attacker must be able to write a symlink into a trusted directory), which limits the attack surface. The EPSS score is approximately 0.364%, reflecting low near-term exploitation probability (GitHub Advisory, Red Hat Bugzilla).

1. Identify a writable location within a trusted directory: Determine if the target application exposes a file upload feature or other write mechanism that places files within a directory listed in Smarty's secure_dir or template directories.
2. Create a malicious symlink: Using the write access, create a symbolic link inside the trusted directory that points to a sensitive file outside the sandbox (e.g., ln -s /etc/passwd /var/www/uploads/secret_link).
3. Trigger template rendering: Craft or manipulate a request that causes a Smarty template to reference the symlink via {include file="/var/www/uploads/secret_link"} or {fetch file="/var/www/uploads/secret_link"}.
4. Bypass the trust check: On vulnerable versions, Security::_checkDir() resolves the symlink path as a string only, so the symlink's location inside the trusted directory passes validation.
5. Read arbitrary file contents: file_get_contents() follows the symlink to the target outside the sandbox, and the contents (e.g., /etc/passwd) are returned to the attacker via the template output (GitHub Advisory, Fix Commit).

• File System: Unexpected symbolic links within Smarty secure_dir, template directories, or user-upload directories that point to files outside those directories (e.g., /etc/passwd, application config files, .env files).
• Logs: Web server or PHP error logs showing Smarty template rendering requests that reference unusual file paths within trusted directories; access log entries with parameters referencing symlink filenames.
• Process: PHP process accessing sensitive system files (e.g., /etc/passwd, /etc/shadow, application secrets) that would not normally be read during template rendering.

Upgrade to Smarty 5.8.2 (for the 5.x line) or 4.5.7 (for the 4.x line), which fix the vulnerability by replacing Smarty::_realpath() with PHP's native realpath() in Security::_checkDir(), ensuring symlinks are fully resolved before trust validation (v5.8.2 Release, v4.5.7 Release). As a workaround for those unable to upgrade immediately, ensure that no untrusted processes or users have write access to any directory listed in secure_dir or the configured template/trusted directories, preventing symlink creation by untrusted parties (GitHub Advisory).