This vulnerability arises from the Security::_checkDir() method in Smarty, which fails to normalize symbolic links before verifying that a requested path resides inside a secure directory. An attacker who can create or reference a symlink inside a directory that Smarty treats as trusted—such as a template or configuration folder—can redirect the lookup to arbitrary files readable by the PHP process, thereby bypassing containment checks. The flaw manifests as a classic path traversal violation, identified as CWE‑22 and CWE‑61.

The issue affects the Smarty PHP template engine before version 5.8.2 on the 5.x line and before version 4.5.7 on the 4.x line. These versions are identified under the vendor/product pair smarty‑php:smarty. The fix was included in releases 5.8.2 and 4.5.7, and the corresponding commits are logged in the project's GitHub repository.

The CVSS score of 6.9 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS value is reported, so the current exploitation probability cannot be quantified from the available data. The likely attack vector is local or remote, contingent upon the ability for an attacker to create or reference a symbolic link within a Smarty‑trusted directory. If the application exposes write or file‑selection capabilities in those directories, the risk is higher; otherwise, the exposure is limited to systems that can influence the file system structure.