[MEDIUM] Smarty Security stream restriction bypass through stream: resource

PKSA-7cg9-1cz1-3qff CVE-2026-62996 GHSA-rjhh-76wf-8xmw

Affected version: >=5.0.0,<5.8.4

Reported by:
GitHub

[MEDIUM] Smarty: Symlink path traversal out of trusted directories

PKSA-zw1q-6h4d-mf1m CVE-2026-62992 GHSA-f6wf-28g6-769x

Affected version: <4.5.7|>=5.0.0,<5.8.2

Reported by:
GitHub

[HIGH] Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag

PKSA-5rsx-p2fk-h2gr CVE-2024-35226 GHSA-4rmg-292m-wg3w

Affected version: >=3.0.0,<4.5.3|>=5.0.0,<5.1.1

Reported by:
GitHub