← All advisories

Critical severity9.8NVD Advisory· Published Feb 22, 2021· Updated Jun 17, 2026

CVE-2021-26120

CVE-2021-26120

Description

Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
smarty/smartyPackagist	< 3.1.39	3.1.39

Affected products

6

Smarty/Smarty
cpe:2.3:a:smarty:smarty:*:*:*:*:*:*:*:*
Range: <3.1.39
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Smarty/Smartydescription
ghsa-coords
pkg:composer/smarty/smarty
Range: < 3.1.39

Patches

Vulnerability mechanics

References

12

security.gentoo.org/glsa/202105-06nvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-3rpf-5rqv-689qghsaADVISORY
github.com/smarty-php/smarty/blob/master/CHANGELOG.mdnvdRelease NotesThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2021/04/msg00004.htmlnvdMailing ListThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2021/04/msg00014.htmlnvdMailing ListThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2021-26120ghsaADVISORY
www.debian.org/security/2022/dsa-5151nvdThird Party AdvisoryWEB
github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-26120.yamlghsaWEB
github.com/smarty-php/smarty/blob/master/CHANGELOG.mdghsaWEB
github.com/smarty-php/smarty/commit/165f1bd4d2eec328cfeaca517a725b46001de838ghsaWEB
github.com/smarty-php/smarty/security/advisories/GHSA-3rpf-5rqv-689qghsaWEB
srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.htmlghsaWEB

News mentions

0

No linked articles in our index yet.