Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents outside the intended template/config scope. This issue is fixed in version 5.8.4.

Affected: Packagist: smarty/smarty

`smarty/smarty` version `5.8.0` can read local files through PHP stream wrappers even when Smarty Security is enabled and all streams are disabled with `Security::$streams = null`.

The bypass uses Smarty's built-in `stream:` resource type. A template such as:

```smarty {include file="stream:php://filter/read=convert.base64-encode/resource=/tmp/secret.tpl"} ```

is handled as Smarty resource type `stream`, so the security check that would normally reject the underlying `php` wrapper is not applied. `StreamPlugin` then opens the nested `php://filter/...` URI directly.

For comparison, the direct resource:

```smarty {include file="php://filter/read=convert.base64-encode/resource=/tmp/secret.tpl"} ```

is blocked with `stream 'php' not allowed by security setting`.

Affected package:

- Ecosystem: Packagist / Composer - Package: `smarty/smarty` - Confirmed affected version: `5.8.0` - Confirmed source reference from Composer lock: `78d259d3b971c59a0cd719c270cc5cbb740c36a7` - Current stable version on Packagist at review time: `v5.8.0` - Packagist usage at review time: 41,113,855 total downloads and 840,604 monthly downloads

Relevant code paths:

- `Smarty\Resource\BasePlugin::load(...)` - `Smarty\Resource\StreamPlugin::getContent(...)` - `Smarty\Security::isTrustedStream(...)`

`BasePlugin::load()` maps the built-in resource name `stream` directly to `StreamPlugin` before the code path that checks PHP stream wrappers with `stream_get_wrappers()` and `Security::isTrustedStream…

Affected: Ubuntu:Pro:16.04:LTS: smarty3, Ubuntu:Pro:18.04:LTS: smarty3, Ubuntu:Pro:20.04:LTS: smarty3, Ubuntu:22.04:LTS: smarty3, Ubuntu:24.04:LTS: smarty3, Ubuntu:24.04:LTS: smarty4, Ubuntu:26.04:LTS: smarty3, Ubuntu:26.04:LTS: smarty4

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents outside the intended template/config scope. This issue is fixed in version 5.8.4.