Critical Vulnerability in Popular PHP Library: Threat to Thousands of Websites

Online Python Trainer for Beginners

Learn Python easily without overwhelming theory. Solve practical tasks with automatic checking, get hints in Russian, and write code directly in your browser — no installation required.

Start Course

Critical Vulnerability in Popular PHP Library: What Developers Need to Know

A cybersecurity research team from SonarSource has published a report on a critical vulnerability discovered in one of the most common PHP libraries for working with templates — Smarty. The vulnerability, identified as CVE-2024-35227, allows an attacker to remotely execute arbitrary code on the server, which could lead to complete compromise of the web application.

Vulnerability Details

The issue is related to the user input processing mechanism in the fetch() function of the Smarty library. With insecure configuration and a lack of data filtering, an attacker can pass a malicious string that will be interpreted as PHP code. On the CVSS v3.1 scale, the vulnerability received a maximum score of 9.8 (Critical).

Key characteristics of the vulnerability:

Attack vector: Network
Exploitation complexity: Low
Required privileges: None
Integrity impact: High

Affected Versions

The vulnerability affects all versions of the Smarty library up to 4.3.2 and 5.0.1. The library developers have already released patches in versions 4.3.3 and 5.0.2 respectively. All users are strongly advised to update the library immediately.

How to Check Your Project for the Vulnerability

To ensure your project is not at risk, follow these steps:

Check the Smarty version in the composer.json or vendor/smarty/smarty/Smarty.class.php file.
If the version is below 4.3.3 or 5.0.2 (depending on the branch), perform an update: composer update smarty/smarty.
Check all places in the code where the fetch() function is used with user data.

Protection Recommendations

In addition to immediately updating the library, experts advise following general security rules:

Always filter and escape user input.
Use the principle of least privilege for file operations.
Regularly update all project dependencies.
Apply static application security testing (SAST) tools to find vulnerabilities.

History and Context

Smarty is one of the oldest PHP templating libraries, released in 2004. It is used in popular CMS such as Drupal (via modules), PrestaShop, and many custom projects. According to analyst estimates, the vulnerability potentially affects more than 100,000 websites worldwide.

This is not the first serious security issue in the library. In 2021, vulnerability CVE-2021-29454 was discovered, related to template injection. Smarty developers promptly release fixes, but the number of outdated versions in production remains high.