CVE-2022-29221
PHP Code Injection by malicious block or filename in Smarty
Description
### Impact Template authors could inject php code by choosing a malicous {block} name or {include} file name. Sites that cannot fully trust template authors should update asap. ### Patches Please upgrade to the most recent version of Smarty v3 or v4. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ ### References _Are there any links users can visit to find out more?_ ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
How to fix CVE-2022-29221
To remediate CVE-2022-29221, upgrade the affected package to a fixed version below.
- —upgrade to 3.1.39-2+deb11u1 or later
- —upgrade to 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u6 or later
- —upgrade to 4.1.1-1 or later
- —upgrade to 3.1.45 or later
Is CVE-2022-29221 being exploited?
Moderate — EPSS is 25.5%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (4)
- from 0, < 3.1.39-2+deb11u1
- from 0, < 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u6
- from 0, < 4.1.1-1
- from 0, < 3.1.45
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |