[MEDIUM] Smarty: Symlink path traversal out of trusted directories

PKSA-zw1q-6h4d-mf1m CVE-2026-62992 GHSA-f6wf-28g6-769x

Affected version: <4.5.7|>=5.0.0,<5.8.2

Reported by:
GitHub

[HIGH] Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag

PKSA-5rsx-p2fk-h2gr CVE-2024-35226 GHSA-4rmg-292m-wg3w

Affected version: >=3.0.0,<4.5.3|>=5.0.0,<5.1.1

Reported by:
GitHub