Skip to content
Vulnerability intelligence

CVE-2026-82531: Smarty code injection (CVSS 4.0)

A value left empty during template inheritance lets forged markers through, apparently by removing a check

CVSS 4.0 2026
What WebPulse reported · 1 analysis
Smarty flaw lets forged data run as PHP code; fixes are in 4.5.8 and 5.8.5

A value left empty during template inheritance lets forged markers through, apparently by removing a check

October 7, 2026
View CVE-2026-82531 on the NIST National Vulnerability Database →
Related vulnerabilities
CVE-2026-9082 CVE-2026-60137 CVE-2026-50549 CVE-2026-50548 CVE-2026-8206 CVE-2026-8181 CVE-2026-63030 CVE-2026-10795