DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-59989: CVE-2026-59989: Remote Code Execution via Server-Side Template Injection in Phalcon Volt Engine

#security #cve #cybersecurity

CVE-2026-59989: Remote Code Execution via Server-Side Template Injection in Phalcon Volt Engine

Vulnerability ID: CVE-2026-59989
CVSS Score: 9.2
Published: 2026-08-21

A critical server-side template injection (SSTI) vulnerability exists in the Volt template engine of the Phalcon PHP framework. In versions 5.15.0 and earlier, raw AST token values for filter arguments in the 'join' filter are directly spliced into the generated PHP template code. This allows an attacker who can influence Volt templates to execute arbitrary PHP code during template rendering.

TL;DR

Phalcon Volt template engine directly concatenates raw AST tokens in the 'join' filter, allowing remote code execution if template contents are user-controlled.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94, CWE-1336
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 9.2 (Critical)
  • Exploit Status: PoC (Proof of Concept)
  • KEV Status: Not Listed
  • Affected Component: Volt Template Compiler (join filter)

Affected Systems

  • Phalcon Framework (phalcon/cphalcon)
  • cphalcon: <= 5.15.0 (Fixed in: 5.16.0)

Code Analysis

Commit: e434061

Fix join Volt filter parameter compilation

@@ -2542,8 +2542,8 @@ class Compiler implements InjectionAwareInterface\n             case \"format\":\n                 return \"sprintf(\" . arguments . \")\";\n             case \"join\":\n-                return \"join('\" . funcArguments[1][\"expr\"][\"value\"]\n-                    . \"', \" . funcArguments[0][\"expr\"][\"value\"] . \")\";\n+                return \"join(\" . this->expression(funcArguments[1][\"expr\"])\n+                    . \", \" . this->expression(funcArguments[0][\"expr\"]) . \")\";\n             case \"json_encode\":\n                 return \"json_encode(\" . arguments . \")\";
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade Phalcon framework to version 5.16.0 or later.
  • Perform code audits to eliminate dynamic Volt template generation patterns from untrusted variables.
  • Implement restrictive input validation to sanitize characters like single quotes in dynamic configurations.

Remediation Steps:

  1. Verify the installed Phalcon version using 'php --ri phalcon' or composer.lock.
  2. Update Phalcon via composer using 'composer update phalcon/cphalcon'.
  3. Clear existing Volt template caches to force recompilation of all templates using the updated secure compiler.

References

Read the full report for CVE-2026-59989 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)