CVE-2009-5054: Smarty Does Not Consider Umask Values When Setting Permissions

The vulnerability stems from Smarty's file creation process not accounting for the system umask. The writeFile function is responsible for writing template cache/compile files and historically used hardcoded 0666 permissions. Since PHP's chmod() operates in absolute mode (overriding umask), this would leave files with permissions of (0666 & ~umask) instead of properly restricting them via (default_permissions & umask). The patched version would subtract the umask from the desired permissions, which aligns with the vulnerability description and CWE-281's improper permission preservation context.