Advisories » MGASA-2026-0585

Updated php-smarty package fixes a security vulnerability

Publication date: 09 Nov 2026
Modification date: 09 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-82531

Description

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection
vulnerability where the top-level nocache_hash is never restored during
extends:/multi-component template inheritance, leaving it null.
Attackers can supply assigned data containing a forged SmartyNocache
marker that is copied verbatim into the regenerated PHP cache file,
executing arbitrary PHP on include for remote code execution.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36622
• https://github.com/smarty-php/smarty/releases#release-v5.8.5
• https://github.com/smarty-php/smarty/releases#release-v5.8.4
• https://github.com/smarty-php/smarty/releases#release-v5.8.3
• https://github.com/smarty-php/smarty/releases#release-v5.8.2
• https://github.com/smarty-php/smarty/releases#release-v5.8.1
• https://github.com/smarty-php/smarty/releases#release-v5.8.0
• https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x
• https://www.cve.org/CVERecord?id=CVE-2026-82531

SRPMS

10/core

• php-smarty-5.8.5-1.mga10