NVD HIGH: CVE-2026-82531 — Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability...

Tuesday, October 6, 2026 at 01:16 PM UTC·Source: NIST NVD

Updated: Tuesday, October 6, 2026 at 06:00 PM UTC

Executive Summary

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-82531

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 6, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Pepkor's $1.3bn fintech deal comes under shareholder scrutiny

South African retailer Pepkor is facing complaints from directors and investors over a deal to merge its fintech arm with a rival company.

1h agoFinextra

MEDIUMVulnerability

Net Closes Around ShinyHunters with Another FBI Arrest

The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHunters

1h agoInfosecurity Magazine

CRITICALVulnerability

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

CVE-2026-85097

2h agoThe Hacker News