CVE-2021-26120: Smarty template engine code injection via function name

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and full code execution impact, plus a very high EPSS score, make this an urgent patch target despite no KEV listing.

What it is

Smarty before 3.1.39 allows code injection through an unexpected function name following a {function name= substring in a template. Because Smarty is a PHP template engine, injected code executes in the context of the hosting application, making this a serious remote code execution risk wherever untrusted template content is processed.

Impact

An attacker can inject and execute arbitrary code in the PHP process running the application, leading to full compromise of confidentiality, integrity and availability of the affected host.

Attack surface

The flaw is reachable over the network with no authentication and no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N). It is triggered by supplying crafted template content containing a {function name= substring, so any application that lets untrusted input reach Smarty template compilation is exposed.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.823 (99.6th percentile), indicating strong predicted exploitation activity. Reference tags are release notes, mailing lists and patch advisories only; no public exploit reference is included in the record.

What to do

• Upgrade Smarty to 3.1.39 or later; apply the vendor release containing the fix.
• Apply the Debian and Gentoo security updates (DSA-5151, GLSA 202105-06) on distributions shipping the affected package.
• Do not pass user-controlled or otherwise untrusted content into Smarty templates; treat template sources as trusted code.
• Where feasible, sandbox or restrict the PHP process running Smarty to limit the blast radius of code execution.

Detection

• Search application and web logs for template input containing the string {function name= or unusual function names in template parameters.
• Monitor for unexpected child processes, outbound connections or file writes originating from the PHP/web server process.
• Audit template storage and upload paths for recently modified or newly introduced template files.
• Alert on Smarty version strings below 3.1.39 in deployed applications and dependency manifests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.