VulnerableCode Package Details - pkg:composer/smarty/smarty@3.0.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-3xs3-13we-6ffu Aliases: CVE-2017-1000480 GHSA-9m49-vhwv-422g	Code Injection Smarty 3 is vulnerable to a PHP code injection when calling `fetch()` or `display()` functions on custom resources that does not sanitize template name.	3.1.32 Affected by 11 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.3.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-a3yk-8fmf-x7fw Aliases: CVE-2024-35226 GHSA-4rmg-292m-wg3w	Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag Template authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.	4.5.3 Affected by 0 other vulnerabilities. 5.1.1 Affected by 0 other vulnerabilities. 5.2.0 Affected by 0 other vulnerabilities.
VCID-vnb9-5w8q-r3bd Aliases: CVE-2018-16831 GHSA-65j5-vpm7-6xp4	Path Traversal Smarty allows attackers to bypass the `trusted_dir` protection mechanism via a `/../` substring in an `include` statement.	3.1.33 Affected by 9 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.3.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-3xs3-13we-6ffu
Aliases:
CVE-2017-1000480
GHSA-9m49-vhwv-422g

Code Injection Smarty 3 is vulnerable to a PHP code injection when calling `fetch()` or `display()` functions on custom resources that does not sanitize template name.

3.1.32
Affected by 11 other vulnerabilities.

4.3.3
Affected by 1 other vulnerability.

VCID-a3yk-8fmf-x7fw
Aliases:
CVE-2024-35226
GHSA-4rmg-292m-wg3w

Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag Template authors could inject php code by choosing a malicous file name for an extends-tag. Users that cannot fully trust template authors should update asap.

4.5.3
Affected by 0 other vulnerabilities.

5.1.1
Affected by 0 other vulnerabilities.

5.2.0
Affected by 0 other vulnerabilities.

VCID-vnb9-5w8q-r3bd
Aliases:
CVE-2018-16831
GHSA-65j5-vpm7-6xp4

Path Traversal Smarty allows attackers to bypass the `trusted_dir` protection mechanism via a `/../` substring in an `include` statement.

3.1.33
Affected by 9 other vulnerabilities.

4.3.3
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-08T19:46:47.718122+00:00	GHSA Importer	Affected by	VCID-3xs3-13we-6ffu	https://github.com/advisories/GHSA-9m49-vhwv-422g	38.6.0
2026-06-05T21:44:00.716763+00:00	GHSA Importer	Affected by	VCID-a3yk-8fmf-x7fw	https://github.com/advisories/GHSA-4rmg-292m-wg3w	38.6.0
2026-06-04T16:21:48.248660+00:00	GitLab Importer	Affected by	VCID-a3yk-8fmf-x7fw	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/smarty/smarty/CVE-2024-35226.yml	38.6.0
2026-06-02T04:38:13.624675+00:00	GitLab Importer	Affected by	VCID-vnb9-5w8q-r3bd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/smarty/smarty/CVE-2018-16831.yml	38.6.0
2026-06-02T04:37:24.454093+00:00	GitLab Importer	Affected by	VCID-3xs3-13we-6ffu	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/smarty/smarty/CVE-2017-1000480.yml	38.6.0