DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54718: CVE-2026-54718: Remote Code Execution via Advanced Workflow Email Template in Silverstripe

#security #cve #cybersecurity

CVE-2026-54718: Remote Code Execution via Advanced Workflow Email Template in Silverstripe

Vulnerability ID: CVE-2026-54718
CVSS Score: 7.2
Published: 2026-08-27

A Server-Side Template Injection (SSTI) vulnerability in the Silverstripe Advanced Workflow module allows authenticated attackers with workflow authoring permissions to achieve arbitrary code execution. By manipulating the NotifyUsersWorkflowAction.EmailTemplate field, attackers can inject template code that dynamically executes arbitrary PHP commands via the core translation helper interpolation path.

TL;DR

An authenticated template injection vulnerability in Silverstripe Advanced Workflow allows high-privileged users to achieve Remote Code Execution via translation tag interpolation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1336
  • Attack Vector: Network (AV:N)
  • CVSS Score: 7.2 (High)
  • EPSS Score: N/A (Recently Disclosed)
  • Impact: Remote Code Execution (RCE)
  • Exploit Status: PoC Available in Regression Tests
  • KEV Status: Not Listed

Affected Systems

  • Silverstripe CMS installations utilizing Advanced Workflow module (< 6.4.5, 7.x < 7.1.3, 7.2.x < 7.2.1)
  • silverstripe-advancedworkflow: < 6.4.5 (Fixed in: 6.4.5)
  • silverstripe-advancedworkflow: >= 7.0.0, < 7.1.3 (Fixed in: 7.1.3)
  • silverstripe-advancedworkflow: >= 7.2.0, < 7.2.1 (Fixed in: 7.2.1)

Code Analysis

Commit: 28d0b53

Merge pull request #629 from sboyd/pulls/6.4/security-ssti

Commit: f170766

Merge pull request #630 from sboyd/pulls/7.1/security-ssti

Mitigation Strategies

  • Upgrade Silverstripe core packages to versions incorporating the hardened template parser engine.
  • Restrict raw web-writable execution patterns inside standard public directories.
  • Deploy Web Application Firewall rules targeting translation-tag nesting structures.

Remediation Steps:

  1. Navigate to the root directory of the Silverstripe project.
  2. Run 'composer update silverstripe/framework silverstripe/template-engine symbiote/silverstripe-advancedworkflow'.
  3. Verify that silverstripe/template-engine is version 1.0.1 or higher (v6 projects) or silverstripe/framework is 5.4.30 or higher (v5 projects).
  4. Rebuild the template manifest using 'sake dev/build' or '?flush=all' in the browser.

References

Read the full report for CVE-2026-54718 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)