-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly states that fetch() and display() are vulnerable when used with custom resources that lack template name sanitization. These functions are core Smarty methods responsible for rendering templates. The CWE-94 classification confirms code injection occurs via improper input control in template handling. Multiple advisories (GitHub, NVD, Debian) consistently reference these functions in the exploit context, and the patch in v3.1.32 would address their input validation logic for custom resources.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| smarty/smarty | composer | >= 3, < 3.1.32 | 3.1.32 |