[GHSA] GHSA-cq55-c7wv-pxmq (medium) — Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

GHSA-cq55-c7wv-pxmq Severity: medium CVE: CVE-2026-62993

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

When a Security policy is active, {fetch} validates the requested remote URL against the trusted_uri allowlist via Security::isTrustedUri(). For non-http:// schemes (e.g. https://) the resource was then read with file_get_contents(), which follows HTTP redirects by default. Beca