High severityNVD Advisory· Published Nov 3, 2014· Updated May 6, 2026
CVE-2014-8350
CVE-2014-8350
Description
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
smarty/smartyPackagist | < 3.1.21 | 3.1.21 |
Affected products
100cpe:2.3:a:smarty:smarty:1.4.6:*:*:*:*:*:*:*+ 99 more
- cpe:2.3:a:smarty:smarty:1.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.5.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.5.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:*:*:*:*:*:*:*:*range: <=3.1.20
- cpe:2.3:a:smarty:smarty:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.0a:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.0b:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.0:b1:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.0:b2:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.12:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.13:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.14:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.15:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.16:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.17:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.18:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.20:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.22:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.24:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.25:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.26:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta8:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.16:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.17:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.18:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.19:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- seclists.org/oss-sec/2014/q4/420nvdExploitWEB
- seclists.org/oss-sec/2014/q4/421nvdExploitWEB
- bugs.debian.org/cgi-bin/bugreport.cginvdExploitWEB
- github.com/advisories/GHSA-2pmx-6mm6-6v72ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2014-8350ghsaADVISORY
- advisories.mageia.org/MGASA-2014-0468.htmlnvdWEB
- www.mandriva.com/security/advisoriesnvdWEB
- www.securityfocus.com/bid/70708nvdWEB
- code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txtnvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/97725nvdWEB
News mentions
0No linked articles in our index yet.