CVE-2026-62996

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the stream resource type, which allows bypassing intended security checks on PHP stream wrappers. An attacker can read arbitrary local files accessible to the PHP process by including specially crafted templa...