VYPR
← All advisories
High severity8.8NVD Advisory· Published Jan 10, 2022· Updated Jun 17, 2026

CVE-2021-21408

CVE-2021-21408

Description

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
smarty/smartyPackagist
< 3.1.433.1.43
smarty/smartyPackagist
>= 4.0.0, < 4.0.34.0.3

Affected products

8
  • Smarty/Smarty2 versions
    cpe:2.3:a:smarty:smarty:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:smarty:smarty:*:*:*:*:*:*:*:*range: <3.1.43
    • (no CPE)range: < 3.1.43
  • Debian/linux3 versions
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • Fedoraproject/Fedora2 versions
    cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:composer/smarty/smarty
    Range: < 3.1.43

Patches

Vulnerability mechanics

References

14

News mentions

0

No linked articles in our index yet.