CVE-2022-29221
Published: 24 May 2022
Summary
CVE-2022-29221 is a high-severity Code Injection (CWE-94) vulnerability in Debian Debian Linux. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 3.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Smarty is a PHP template engine that separates presentation from application logic. CVE-2022-29221 is a code-injection vulnerability (CWE-94) affecting versions prior to 3.1.45 and 4.1.1, in which a template author can supply a malicious {block} name or {include} file name that results in the engine emitting and executing arbitrary PHP code.
An attacker who can control or influence template content—such as an untrusted user, plugin author, or compromised template repository—can exploit the flaw over the network with low attack complexity to obtain full code execution on the web server. The CVSS 8.8 score reflects the resulting high impact on confidentiality, integrity, and availability when the vulnerable component is reached with limited privileges.
The official GitHub security advisory GHSA-634x-pc3q-cf4c and the linked release tags state that sites unable to fully trust template authors should upgrade immediately to 3.1.45 or 4.1.1; no workarounds are known. Corresponding patches appear in the referenced commits, and downstream distributions such as Debian have issued coordinated advisories.
The EPSS score has remained at its observed peak of 0.2550 with no material post-disclosure climb.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-2696
Vulnerability details
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that…
more
cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.