CVE-2008-4810: The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 before r2797 allows rem...

Security readout for executives and security teams

CVE-2008-4810 is an old Smarty template-engine issue where specially handled template text could lead to arbitrary PHP execution. The business risk is highest for legacy PHP applications that let users, administrators, CMS content, or imported data influence Smarty templates. Exposure is likely limited to legacy PHP applications bundling or installing Smarty 2.6.20-era code, especially where template source is editable, user-controlled, or populated from untrusted data. The source bundle does not identify modern supported products beyond Smarty itself. Prioritize remediation for internet-facing or multi-user legacy PHP systems using old Smarty. The vulnerability can become code execution, but evidence in the bundle does not support active exploitation claims. Mitigation focus: Upgrade Smarty to a release or package containing the r2797 fix.; Apply distribution vendor updates, such as Debian guidance where applicable.; Remove untrusted write access to Smarty templates and compiled-template paths..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.