The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smartyinternalcompileprivatespecial_variable.php file.
{ "urgency": "not yet assigned" }