The PHP template engine under your storefront needs a quiet update

Smarty, the PHP template engine sitting under a lot of storefronts and control panels you did not choose on purpose, shipped a quiet code-injection fix over the weekend. The CVE identifier arrived Tuesday. If caching is on and attacker-controlled text is rendered unescaped through multi-component template inheritance, that text can forge a cache marker and run as PHP the next time the cache is included.

Most teams did not pick Smarty. It arrived under a vendor app. Check the lockfile anyway.

What happened

CVE-2026-82531 covers Smarty before 4.5.8 and 5.x before 5.8.5. VulnCheck published the CVE on October 6, 2026; Smarty 5.8.5 and the project advisory GHSA-3w63-v7pm-cq9x landed October 4, with 4.5.8 on the 4.x line. The CVSS 4.0 score on the CVE record is 9.2. The project advisory labels it High.

The mechanism: during extends: / multi-component inheritance the top-level nocache_hash is left null. That null collapses into an empty alternative in Smarty’s own cache-marker regex, so attacker-controlled page output can forge a SmartyNocache marker whose raw content is copied into the regenerated PHP cache file — skipping the usual PHP-tag neutralization — and executed on the next include. Credit: MegaManSec.

Why it matters

Packagist shows tens of millions of installs and hundreds of dependent packages. Direct users can composer update today. Downstream users wait for a vendor release that bumps the pin, and many of those vendors will never publish their own advisory for a dependency bump. The five preconditions (caching on, escaping off, multi-component extends, unescaped attacker data, cache regeneration) are real constraints — and they are also the exact shape of a high-traffic PHP app.

What to do first

• Update smarty/smarty to 5.8.5 (5.x) or 4.5.8 (4.x).
• Clear compiled-template and cache directories after the update. A patched binary can still include a poisoned cache file written before the fix.
• If you cannot update yet: turn off template caching, or enable HTML escaping on assigned output, or stop rendering attacker-controlled values unescaped into extends: templates. Any one breaks the chain.
• Ask every PHP vendor whose product embeds Smarty whether their next build includes 4.5.8 / 5.8.5. Do not wait for a customer-facing advisory that may never come.

Details

• CVE: CVE-2026-82531 — CWE-94 code injection via forged nocache marker. CVE CVSS 4.0: 9.2. Project advisory: High (GHSA-3w63-v7pm-cq9x).
• Fixed: Smarty 4.5.8 and 5.8.5 (released October 4, 2026). CVE published October 6.
• Preconditions (all required): caching enabled; HTML escaping disabled; multi-component extends: inheritance; attacker-controlled assigned data output unescaped; cache regeneration after compiled files exist.
• Exploitation: Not reported by the project or VulnCheck at disclosure.
• Reporter: MegaManSec.

Hunt / verify

• Check composer.lock for smarty/smarty below 4.5.8 / 5.8.5.
• After updating, delete the compiled and cache directories so old poisoned files cannot be included.
• Grep cache directories for SmartyNocache markers with an empty hash, and for unexpected <?php / <?= inside cache files that should only hold rendered content.
• Confirm vendor release notes for any bundled Smarty bump; escalate if silent.

Smarty CVE-2026-82531 (code injection via nocache marker): update to 4.5.8 or 5.8.5, then clear template/cache dirs. Check composer.lock and every PHP vendor that embeds Smarty. Fix landed Oct 4; CVE Oct 6. Not reported exploited.

Sources

• https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x
• https://www.vulncheck.com/advisories/smarty-before-4.5.8-and-5-x-before-5.8.5-php-code-injection-via-extends-inheritance-cache
• https://severitydaily.com/smarty-cve-2026-82531-null-nocache-hash-empty-regex-alternative-4-5-8-5-8-5/
• https://www.cve.org/CVERecord?id=CVE-2026-82531
• https://packagist.org/packages/smarty/smarty

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].