CVE-2011-1028: Debian Linux

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_variable.php file.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Smarty Smarty: from 3.0.0, before 3.0.7 (fixed in 3.0.7)

Published 2019-11-20. Last modified 2026-06-16.