CVE-2025-46661 is a critical server-side template injection flaw (CVSS 10.0) in IPW Systems Metazo through version 8.1.3. The record says an unauthenticated attacker can run code through smartyValidator.php. The supplier says all instances have been patched, so confirm with IPW that yours is.
What's affected
The NVD record lists IPW Systems Metazo through version 8.1.3. The record adds that all instances have been patched by the supplier, which suggests the product is delivered and updated by IPW. It does not name a fixed version number.
The record points to a public vulnerability list from Code White and to the supplier's site. If you use Metazo, the practical step is a direct question to IPW about the patch state of your instance.
How to check if you're exposed
Metazo is a supplier hosted or supplier managed product in many deployments, so start by asking who runs it.
- Find out whether your Metazo instance is hosted by IPW or run by your own team.
- Ask IPW in writing which version your instance runs and when it was patched for this issue.
- If you run it yourself, read the version from the admin interface and compare it with 8.1.3.
- Review web logs for requests to smartyValidator.php, especially from unfamiliar addresses.
- Check the server for unexpected files and processes if you cannot confirm the patch date.
What to do now
- Contact IPW Systems and ask for written confirmation that your instance is patched.
- If you run the software yourself, apply the supplier's update and confirm that the version is newer than 8.1.3.
- Review web server logs for access to smartyValidator.php for as long as your logs go back, and investigate any matches.
- Limit access to the application to the networks that need it, using a firewall or reverse proxy.
- If you cannot confirm the patch, take the instance offline or restrict it until you can.
- Rotate credentials and keys stored on the server if logs show suspicious requests.
Why it matters
The record lists CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), CWE-94 (Improper Control of Generation of Code (Code Injection)). Template engines turn data into pages. If user input is treated as part of the template and not as plain data, the engine runs the input as code. That is what server-side template injection means.
The vector gives the maximum score of 10.0, which reflects network reach, no login, and a changed scope. The supplier's statement that all instances are patched lowers the practical risk, but the only way to be sure is to ask about your own instance. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is Metazo already fixed?
The record says all instances have been patched by the supplier. Ask IPW to confirm that yours is.
Which version number is fixed?
The record names none. It lists versions through 8.1.3 as affected.
Sources
Last reviewed: 18 October 2026.
