A medium-severity vulnerability, identified as CVE-2026-62993 with a CVSS score of 6.9, affects Smarty and allows server-side request forgery via a redirect bypass of trusted_uri using {fetch}. This flaw occurs when a security policy is active and {fetch} validates the requested remote URL against the trusted_uri allowlist but fails to validate subsequent redirects. An attacker can exploit this vulnerability by supplying a fetch target and leveraging an open redirect on a trusted host to cause the server to issue requests to internal endpoints, thereby bypassing the trusted_uri allowlist. The business impact of this vulnerability is significant, as it enables attackers to defeat security policies and potentially access sensitive information. This vulnerability can be mitigated by avoiding the use of {fetch} in templates under untrusted control and ensuring that hosts listed in trusted_uri do not expose open redirects.
The following reports contain further technical details:[/subscribe_to_unlock_form]
A medium-severity vulnerability, identified as CVE-2026-62993 with a CVSS score of 6.9, affects Smarty and allows server-side request forgery via a redirect bypass of trusted_uri using {fetch}. This flaw occurs when a security policy is active and {fetch} validates the requested remote URL against the trusted_uri allowlist but fails to validate subsequent redirects. An attacker can exploit this vulnerability by supplying a fetch target and leveraging an open redirect on a trusted host to cause the server to issue requests to internal endpoints, thereby bypassing the trusted_uri allowlist. The business impact of this vulnerability is significant, as it enables attackers to defeat security policies and potentially access sensitive information. This vulnerability can be mitigated by avoiding the use of {fetch} in templates under untrusted control and ensuring that hosts listed in trusted_uri do not expose open redirects.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]