The fetch plugin in Smarty validates only the original URL against the trusted_uri allowlist when a security policy is active. When the target URL redirects, PHP follows the redirect by default, letting an attacker redirect the request to an internal endpoint through an open redirect on a trusted host. This bypass permits Server‑Side Request Forgery, enabling attackers to reach internal services, read data, or trigger undesired actions. The vulnerability does not provide arbitrary code execution but can be leveraged for significant internal reconnaissance or exploitation.

All releases of the Smarty template engine for PHP prior to version 4.5.7 on the 4.x line and to version 5.8.2 on the 5.x line are affected, including any 4.x and 5.x releases that do not contain the patch. The vulnerability is linked to the {fetch} helper implemented in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the issue is not listed in CISA KEV. The attack requires an attacker who can influence the fetch target, which typically occurs via a web application that uses the {fetch} tag. The exploit path leverages PHP’s default following of HTTP redirects, a trusted host with an open redirect, and the lack of re‑validation after the redirect. Because the vulnerability relies on application‑level input and environmental conditions, the likelihood of exploitation is moderate in a realistic threat model.