Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
When a Security policy is active, {fetch} validates the requested remote URL against the trusted_uri allowlist via Security::isTrustedUri(). For non-http:// schemes (e.g. https://) the resource was then read with file_get_contents(), which follows HTTP redirects by default. Because isTrustedUri() only validates the initial URL, an open redirect on an otherwise-trusted host could be used to redirect the request to a non-trusted, internal target — bypassing the trusted_uri policy.
Impact
An attacker who can supply a fetch target (or influence one) and who has an open redirect available on a trusted host can cause the server to issue requests to attacker-chosen internal endpoints, defeating the trusted_uri allowlist (server-side request forgery).
Patches
Fixed in 5.8.2. When a security policy is active, {fetch} now passes a stream context that disables redirect following (follow_location => 0, max_redirects => 1) to file_get_contents() for remote resources. Behavior is unchanged when no security policy is set, since there is no trusted_uri to bypass.
Workarounds
Avoid fetching remote resources from within templates under untrusted control; ensure hosts listed in trusted_uri do not expose open redirects.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | smarty/smarty | >= 5.0.0, < 5.8.2, < 4.5.7 | 5.8.2, 4.5.7 |
References
- https://github.com/smarty-php/smarty/security/advisories/GHSA-cq55-c7wv-pxmq
- https://nvd.nist.gov/vuln/detail/CVE-2026-62993
- https://github.com/smarty-php/smarty/pull/1194
- https://github.com/smarty-php/smarty/commit/31e06fc087a8b5a9b236c1e5dacc1c2850a2c115
- https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90
- https://github.com/smarty-php/smarty
- https://github.com/smarty-php/smarty/releases/tag/v4.5.7
- https://github.com/smarty-php/smarty/releases/tag/v5.8.2
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N- Weakness (CWE)
CWE-918- Platform
- Composer
- Package
smarty/smarty- Disclosed
- 01.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-cq55-c7wv-pxmq - CC BY 4.0
Vulnerability history: smarty/smarty
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 18
- First → latest
- 02.2021 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 8
- Medium 7
Disclosures per year
- 2021: 2
- 2022: 11
- 2023: 1
- 2024: 1
- 2025: 0
- 2026: 3
-
Smarty: SSRF via redirect bypass of trusted_uri using {fetch} this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.