CIVI-SA-2015-004 - Malicious Smarty file naming

The Smarty templating engine includes a defect in which a specially named Smarty template could be used to execute PHP code.

An exploit of this vulnerability in CiviCRM has not been identified. Exploiting it requires that an attacker have permission to set the name and content of a template file; in CiviCRM deployments, this permission is generally only available to system administrators. Never-the-less, it could potentially be combined with other vulnerabilities, and we're issuing a patch as a precaution.