Act nowDisclosed

Advisory · CVE-2026-82531

Smarty template cache flaw allows PHP code injection

Smarty before 4.5.8 and 5.x before 5.8.5 mishandles the top-level nocache hash during extends-based template inheritance, letting attacker-supplied data carrying a forged SmartyNocache marker be written verbatim into the regenerated PHP cache file and executed as PHP on include.

Advisory published October 6, 2026Independent summary
Vendor
Smarty
Product
Smarty
Identifier / CWE
CVE-2026-82531
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

Smarty turns page templates into PHP files it keeps on disk. A bug in the multi-template merge step forgets to clean up a special marker, so an attacker can sneak their own marker into page data and get their PHP code saved into that file. The next time the page loads, their code runs.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Template inheritance

    The application renders templates using extends: with multiple component templates.

  2. 02Hash never restored

    During inheritance, the top-level nocache_hash is never restored and stays null.

  3. 03Marker forged

    Attacker-controlled assigned data carries a forged SmartyNocache marker.

  4. 04Cache poisoned

    The marker is copied verbatim into the regenerated PHP cache file.

  5. 05Code executes

    The poisoned cache file is included on a later request, executing the attacker's PHP on the server.

What happened

Smarty versions before 4.5.8 (4.x line) and before 5.8.5 (5.x line) contain a code injection vulnerability in template compilation. When extends: is used with multi-component template inheritance, the top-level nocache_hash is never restored and remains null. Assigned data containing a forged SmartyNocache marker is then copied verbatim into the regenerated PHP cache file, which executes arbitrary PHP when included on a subsequent request.

The flaw is rated critical at CVSS 4.0 9.2 and tracked as CWE-94 (improper control of generation of code). The vendor fixed it in Smarty 4.5.8 and 5.8.5.

What to do

  1. Upgrade Smarty to 4.5.8 or 5.8.5, matching your major line.
  2. Audit the Smarty compile/cache directories for cache files containing unexpected PHP or suspicious markers.
  3. Check whether any application passes attacker-controlled data into template assignments rendered through extends: inheritance.
  4. Review server and application logs for anomalous template rendering or unexpected code execution.
  5. Rotate credentials and secrets if cache poisoning or remote code execution cannot be excluded.

Management note

Smarty powers a large share of PHP applications, and this is a pre-authentication path to remote code execution on the web server. Patching is urgent; the investigation should assume template caches are a possible persistence point until they are rebuilt from clean sources.