This vulnerability allows an attacker to inject code through the extends/inheritance cache mechanism of the Smarty templating engine. The top‑level nocache_hash is never restored during extends or multi‑component template inheritance, leaving it null and enabling the insertion of a forged SmartyNocache marker. When the template is regenerated, the marker is written directly into the PHP cache file, which is then included and executed, leading to arbitrary PHP execution.

The affected versions are all releases of Smarty before 4.5.8 and all versions of the 5.x line before 5.8.5. These include the commonly used Smarty 4.5.x and 5.x branches available from smarty‑php:smarty. Any installation relying on these versions is vulnerable unless upgraded.

The vulnerability carries a high CVSS score of 9.2, indicating a severe risk of remote code execution when exploited. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so the prevalence of exploitation in the wild is unknown. Attackers would need to supply crafted template data containing the forged marker, which is then copied into a regenerated PHP cache file and executed. The risk is high for systems that enable template inheritance or caching without proper input validation.