Skip to content

deps: Upgrade smarty/smarty to version 4.5.4

Harald Eilertsen requested to merge security/update/smarty into dev

This eliminates a potential vulnerability where an template author could inject arbitrary PHP files to be run via the 'extends' tag.

See:

Impact assessment:

In our case I would consider this a low severity issue as we don't allow users to dynamically add or edit smarty templates. Templates has to be updated via merge requests, or by installing a theme. In both cases a malicious attacker already has easier ways to inject whatever code they want.

Further, the extend tag is not in use in any of our core templates.

Merge request reports