Servers and applications
CVE-2026-82531
Missing nocache-hash restoration lets assigned data inject executable PHP into regenerated cache files
- Severity
- Critical 9.2
- Published
- 4 Oct 2026
- Last changed
- 6 Oct 2026
- Added to UpHeron
- 3 Nov 2026
- Fixed in
- 4.5.8, 5.8.5
- Also known as
- GHSA-3w63-v7pm-cq9x
- Sources
- CVE Program, Project advisories (GitHub)
Affected software
| Software | Affected versions |
|---|---|
SmartyServers and applications · cna:smarty-php|smarty |
|
SmartyServers and applications · github:smarty-php/smarty |
|
References
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-82531
- GitHub Advisory Database https://github.com/advisories/GHSA-3w63-v7pm-cq9x
- github.com https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x