CVE-2026-82531

Summary

Smarty template engine contains a code injection vulnerability where forged nocache_hash markers can be copied verbatim into PHP cache files, enabling remote code execution through arbitrary PHP code execution on include. This affects versions before 4.5.8 and 5.x before 5.8.5.

Exploitability

Exploitation requires crafting a specific assigned data structure with a forged SmartyNocache marker that gets embedded into generated cache files, making it moderately difficult but possible for attackers with template rendering access.

Blast radius

If exploited, this vulnerability could lead to full remote code execution on the web server, potentially allowing attackers to execute arbitrary commands, access sensitive data, or compromise the entire application environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Smarty 4.5.8 or 5.8.5 to remediate this code injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.