Smarty, a PHP template engine, allowed the use of arbitrary file names inside the stream: resource-name syntax with the php://filter wrapper from version 5.0.0 up to but not including 5.8.4. This flaw, a Directory Traversal style weakness (CWE‑22), can be leveraged by an attacker who controls or influences a template to read any local file accessible to the PHP process, thereby exposing sensitive configuration, source code, or other privileged data.

The vulnerability affects Smarty PHP template engine versions 5.0.0 through 5.8.3. The issue was resolved in release 5.8.4 and later versions are not impacted.

The CVSS v3.1 score of 6.9 indicates a moderate severity, but the vulnerability remains significant due to the potential for arbitrary local file access. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through templates that are authorable by an attacker or are influenced by external input; based on the description, it is inferred that file disclosure can be achieved via the php://filter wrapper within stream resources.