CVE-2026-62996: 
PHP vulnerability analysis and mitigation

CVE-2026-62996 is a security stream restriction bypass vulnerability in the Smarty PHP template engine, allowing an attacker with template authoring privileges to read arbitrary local files accessible to the PHP process by abusing the built-in stream: resource type. It affects Smarty versions >= 5.0.0 and < 5.8.4 (Composer package smarty/smarty). The vulnerability was published on July 20, 2026, and formally disclosed to the GitHub Advisory Database on August 7, 2026. It carries a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-66 (Improper Handling of File Names that Identify Virtual Resources). In Smarty\Resource\BasePlugin::load(), the built-in stream resource name is mapped directly to StreamPlugin before the code path that invokes stream_get_wrappers() and Security::isTrustedStream(), meaning the nested PHP stream wrapper (e.g., php://filter/...) is never validated against the security policy. StreamPlugin::getContent() then calls fopen($filepath, 'r+') on the nested URI directly, bypassing Security::$streams = null and the trusted-directory boundary. A malicious template payload such as {include file="stream:php://filter/read=convert.base64-encode/resource=/etc/passwd"} demonstrates the bypass; a PoC was included in the advisory (Github Advisory, Smarty PR #1195).

Successful exploitation allows a template author to read the contents of any local file readable by the PHP process, including application configuration files, credentials, and other sensitive data, by base64-encoding the output through php://filter and rendering it back in the template response. This bypasses both the Security::$streams = null restriction and the trusted-template-directory boundary that normally blocks path traversal. There is no integrity or availability impact; the vulnerability is limited to confidentiality of the vulnerable system (Github Advisory).

A proof-of-concept (PoC) was included in the original advisory and is publicly available, demonstrating successful file disclosure on Smarty 5.8.0 with Smarty Security enabled and all streams disabled. Exploitation requires high privileges — specifically, the ability to author or influence a template's resource reference — making mass exploitation less likely. The EPSS score is approximately 0.0035 (low probability of exploitation in the wild), and there is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing (Github Advisory, Feedly).

1. Identify target: Confirm the application uses Smarty >= 5.0.0 and < 5.8.4 with $smarty->enableSecurity() and $smarty->security_policy->streams = null configured, and that an attacker can influence template content or resource references.
2. Craft malicious template payload: Construct an include directive using the stream: resource type to wrap a php://filter URI targeting a sensitive file:

   {include file="stream:php://filter/read=convert.base64-encode/resource=/etc/passwd"}

3. Inject or submit the payload: Insert the crafted template directive into any template the application will render — this may be via a CMS template editor, user-controlled template variable, or any other mechanism that allows template content to be influenced.
4. Retrieve file contents: The rendered output will contain the base64-encoded contents of the targeted file. Decode the output (e.g., base64 -d) to recover the plaintext file contents.
5. Pivot as needed: Use disclosed credentials, configuration values, or other sensitive data from the read files to escalate access or move laterally within the environment (Github Advisory, Smarty PR #1195).

• Logs: PHP/web server access logs or application logs showing template rendering requests that include the string stream:php://filter or stream:php:// in template file parameters or rendered template content.
• File System: Unexpected base64-encoded strings in rendered template output or cached compiled templates referencing php://filter URIs.
• Application Behavior: Template rendering returning base64-encoded blobs of file content rather than expected HTML/text output, particularly for templates referencing stream: resource types with nested :// URIs.
• Process: PHP process opening file handles to sensitive files (e.g., /etc/passwd, application .env or config files) via fopen() calls originating from StreamPlugin::getContent() in the Smarty stack (Github Advisory).

Upgrade to Smarty version 5.8.4 or later, which fixes the issue by parsing the nested stream wrapper scheme in StreamPlugin::getContent() and validating it against Security::isTrustedStream() before calling fopen(), giving the stream: resource the same security check as direct wrapper paths (Smarty Release v5.8.4, Smarty PR #1195). As a workaround for environments that cannot immediately upgrade, restrict template authoring to fully trusted users and audit all templates for use of the stream: resource type with nested :// URIs. No configuration-only workaround fully mitigates the bypass in affected versions.