Security readout for executives and security teams
Plain-English summary
Smarty, a PHP template engine, allowed crafted input to its math function to escape intended sandbox limits and run arbitrary PHP code. The business risk is highest for applications where untrusted users or template authors can influence math expressions. Patched Smarty releases are available.
Executive priority
Treat this as a high-priority patch for internet-facing or multi-tenant PHP systems using Smarty. Lower urgency may be reasonable only where vulnerable versions are absent or template math input is fully trusted.
Technical view
CVE-2021-29454 is a CWE-74 injection issue in smarty/smarty before 3.1.42 and in 4.0.0 through 4.0.1. A malicious math string could lead to arbitrary PHP code execution when rendered through Smarty’s math function, especially if user-provided data reached that function.
Likely exposure
Exposure is likely in PHP applications using vulnerable Smarty versions and allowing untrusted template authors, CMS users, plugins, or request data to influence math function strings.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation evidence. Public advisories describe arbitrary PHP code execution, but practical exposure depends on attacker control over a Smarty math string and application rendering behavior.
Researcher notes
The strongest evidence is the GitHub advisory and fixed releases. The CVSS vector is network, low complexity, no privileges, user interaction required, with high confidentiality and integrity impact and no availability impact.
Mitigation direction
- Upgrade Smarty to 3.1.42, 4.0.2, or a later fixed release.
- Apply fixed distro packages from Debian, Gentoo, Fedora, or your package vendor.
- Audit uses of Smarty math where expressions include user-controlled data.
- Restrict untrusted template authoring until fixed versions are deployed.
- Check upstream Smarty guidance before relying on temporary workarounds.
Validation and detection
- Identify installed smarty/smarty versions through Composer, Packagist metadata, or distro package inventory.
- Search templates and code paths for Smarty math function usage.
- Confirm no user-controlled data can reach math expressions before rendering.
- Verify production packages are at 3.1.42, 4.0.2, or vendor-fixed builds.
- Review CMS, plugin, and theme permissions for untrusted template editing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-74: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-29454 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N2.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/smarty-php/smarty/security/advisories/GHSA-29gp-2c3m-3j6mCVE reference
- https://github.com/smarty-php/smarty/commit/215d81a9fa3cd63d82fb3ab56ecaf97cf1e7db71CVE reference
- https://github.com/smarty-php/smarty/releases/tag/v3.1.42CVE reference
- https://github.com/smarty-php/smarty/releases/tag/v4.0.2CVE reference
- https://packagist.org/packages/smarty/smartyCVE reference
- https://www.smarty.net/docs/en/language.function.math.tplCVE reference
- [debian-lts-announce] 20220505 [SECURITY] [DLA 2995-1] smarty3 security updateCVE reference · mailing-list
- DSA-5151CVE reference · vendor-advisory
- GLSA-202209-09CVE reference · vendor-advisory
- FEDORA-2022-52154efd61CVE reference · vendor-advisory
- FEDORA-2022-d5fc9dcdd7CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.