CVE-2026-62992
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.
CVSS
—
No CVSS
EPSS
0.4%
p29
KEV
—
Exploit Today
9
0-100
Published: Aug 7, 2026 · Last modified: Aug 7, 2026 · CWE-22 · CWE-61
0.4%EPSS · 30 days0.4%
2026-08-082026-08-09
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.
- github.comhttps://github.com/smarty-php/smarty/commit/99c048ce7a590c519b79fbd38ad0143a08183a1f
- github.comhttps://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90
- github.comhttps://github.com/smarty-php/smarty/releases/tag/v4.5.7
- github.comhttps://github.com/smarty-php/smarty/releases/tag/v5.8.2
- github.comhttps://github.com/smarty-php/smarty/security/advisories/GHSA-f6wf-28g6-769x
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-725727.5 HIG—
——0A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download(), enabling directory traversal via ../ sequences to access sensitive system files.2hCVE-2026-725717.5 HIG—
——0A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.2hCVE-2026-725699.1 CRI—
——0A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. The lib/middleware/file-remove.js middleware does not sanitize the req.query.file parameter before using it to construct file system paths, enabling directory traversal via ../ sequences.2hCVE-2026-725679.8 CRI—
——0An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repo_type fields without sanitization, enabling path traversal. A second unauthenticated endpoint creates directories, and combined these primitives allow arbitrary file write and delete as the root process user.2hCVE-2026-66484——
——0GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.
This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad2hCVE-2026-193725.3 MED—
——0A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component upload_document. Performing a manipulation of the argument File results in path traversal. Attacking locally is a requirement. The project was informed of the problem early through an issue report but has not responded yet.14h