CVE-2009-5054: Smarty

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.

Affected products

• Smarty Smarty: up to and including 2.6.26; version 1.0 only; version 1.0a only; version 1.0b only; version 1.1.0 only; version 1.2.0 only; …

Published 2011-02-03. Last modified 2026-06-16.