CVE-2018-13982

Published September 18th, 2018

View on NVD ↗

CVSS v3

7.5

HIGH

CVSS v2

MEDIUM

Affected

PROJECTS

Description

Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.

sbaresearch/advisories

Security advisories by SBA Research.

GitHub

smarty-php/smarty

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic.

GitHub

2.35K