Main
Vulnerability Database
Exploits
ID:5162 - Exploit for Security restrictions bypass in Smarty - CVE-2021-26119
ID:5162 - Exploit for Security restrictions bypass in Smarty - CVE-2021-26119
Published: February 23, 2021
Vulnerability identifier: #VU50869
Vulnerability risk: Medium
CVE-ID: CVE-2021-26119
CWE-ID: CWE-264
Exploitation vector: Remote access
Vulnerable software:
Smarty
Smarty
Link to public exploit:
Vulnerability description
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to application does not properly impose security restrictions and allows to escape sandbox by allowing to access the $smarty.template_object. A remote user can perform template injection and execute arbitrary PHP code on the server.
Remediation
Install updates from vendor's website.