by Kastro
Paper/Archive/CVE-2026-59989

CVE-2026-59989

phalcon cphalcon — Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

EPSS 0.5%public exploitCVSS 9.2
critical.is priorityof 100
47
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 45.6.456 × 209.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.

Affected

ProductAffectedFixed inSource
cphalcon< 5.16.0–CNA

Scores by source

GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8refgithub.com/phalcon/cphalcon/pull/17217refgithub.com/phalcon/cphalcon/commit/e434061be3b7161930476c1368c868badc71e1bdrefgithub.com/phalcon/cphalcon/releases/tag/v5.16.0