Which products and versions are affected by CVE-2021-26120?

Affected: Smarty; Debian Linux versions 10.0, 11.0, 9.0; smarty/smarty (composer), among others. The full list is in the CVE brief.

Is CVE-2021-26120 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2021-26120 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2021-26120?

No public exploit code is known.

Is there a fix for CVE-2021-26120?

Fixed versions are available, including Smarty 3.1.39, smarty/smarty 3.1.39, smarty3 3.1.21-1ubuntu1+esm1.

How urgently should CVE-2021-26120 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2021-26120

Critical

PHP Code Injection by malicious function name in smarty

Published Feb 26, 2021 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2021-26120, GHSA-3rpf-5rqv-689q, UBUNTU-CVE-2021-26120

Key Facts

Patch immediately

CVE-2021-26120 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Smarty, Debian Linux, smarty/smarty (composer) and 1 more product.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 82% probability of exploitation in the next 30 days.
Fixed versions are available, including Smarty 3.1.39, smarty/smarty 3.1.39, smarty3 3.1.21-1ubuntu1+esm1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

82%

Higher than 99.6% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2021-26120 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.

Affected Products

20 affected entries in total

Product	Affected versions	Fixed in
SmartySmarty	See advisory	3.1.39
Debian LinuxDebian	10.0, 11.0, 9.0	n/a
smarty/smartycomposer	See advisory	3.1.39
smarty3debian	See advisory	3.1.39-1

Patched Releases

Smarty

3.1.39

smarty/smarty

3.1.39

smarty3

3.1.21-1ubuntu1+esm1, 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u2, 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1, 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1, 3.1.39-1

Timeline

Publicly disclosed
Feb 26, 2021
Last updated
Aug 4, 2026

Weakness Type

CWE-94 Improper Control of Generation of Code ('Code Injection')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.
Affected: Smarty; Debian Linux versions 10.0, 11.0, 9.0; smarty/smarty (composer), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Smarty 3.1.39, smarty/smarty 3.1.39, smarty3 3.1.21-1ubuntu1+esm1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Is CVE-2021-26120 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.