https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:35:23.421307+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-02129 bdu:2022-02129 2026-10-03T20:35:23.521048+00:00 bdu:2022-02129 https://cve.radiocsirt.org/vuln/euvd-2026-234531 EUVD-2026-234531 2026-10-03T20:35:23.521084+00:00 EUVD-2026-234531 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29454 fkie_cve-2021-29454 2026-10-03T20:35:23.521099+00:00

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.

 https://cve.radiocsirt.org/vuln/ghsa-29gp-2c3m-3j6m GHSA-29gp-2c3m-3j6m — Sandbox Escape by math function in smarty 2026-10-03T20:35:23.521131+00:00

Affected: Packagist: smarty/smarty

### Impact Template authors could run arbitrary PHP code by crafting a malicious math string. If a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.

### Patches Please upgrade to 4.0.2 or 3.1.42 or higher.

### References See [documentation on Math function](https://www.smarty.net/docs/en/language.function.math.tpl).

### For more information If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)

 https://cve.radiocsirt.org/vuln/gsd-2021-29454 gsd-2021-29454 2026-10-03T20:35:23.521162+00:00 gsd-2021-29454 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29454 UBUNTU-CVE-2021-29454 2026-10-03T20:35:23.521174+00:00

Affected: Ubuntu:Pro:16.04:LTS: smarty3, Ubuntu:18.04:LTS: smarty3, Ubuntu:Pro:20.04:LTS: smarty3, Ubuntu:22.04:LTS: smarty3

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.