{"uuid": "1413888a-7de3-4af1-97eb-51515bbc040f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59989", "type": "seen", "source": "https://gist.github.com/alon710/6c6dab5e1a3a671fb5c0adb7c14c9092", "content": "# CVE-2026-59989: CVE-2026-59989: Remote Code Execution via Server-Side Template Injection in Phalcon Volt Engine\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59989\n\n## Summary\nA critical server-side template injection (SSTI) vulnerability exists in the Volt template engine of the Phalcon PHP framework. In versions 5.15.0 and earlier, raw AST token values for filter arguments in the 'join' filter are directly spliced into the generated PHP template code. This allows an attacker who can influence Volt templates to execute arbitrary PHP code during template rendering.\n\n## TL;DR\nPhalcon Volt template engine directly concatenates raw AST tokens in the 'join' filter, allowing remote code execution if template contents are user-controlled.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94, CWE-1336\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **Exploit Status**: PoC (Proof of Concept)\n- **KEV Status**: Not Listed\n- **Affected Component**: Volt Template Compiler (join filter)\n\n## Affected Systems\n\n- Phalcon Framework (phalcon/cphalcon)\n- **cphalcon**: <= 5.15.0 (Fixed in: `5.16.0`)\n\n## Mitigation\n\n- Upgrade Phalcon framework to version 5.16.0 or later.\n- Perform code audits to eliminate dynamic Volt template generation patterns from untrusted variables.\n- Implement restrictive input validation to sanitize characters like single quotes in dynamic configurations.\n\n**Remediation Steps:**\n1. Verify the installed Phalcon version using 'php --ri phalcon' or composer.lock.\n2. Update Phalcon via composer using 'composer update phalcon/cphalcon'.\n3. Clear existing Volt template caches to force recompilation of all templates using the updated secure compiler.\n\n## References\n\n- [GitHub Security Advisory GHSA-hrwp-4hh9-c8r8](https://github.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8)\n- [GitHub Pull Request 17217](https://github.com/phalcon/cphalcon/pull/17217)\n- [Fix Commit e434061be3b7161930476c1368c868badc71e1bd](https://github.com/phalcon/cphalcon/commit/e434061be3b7161930476c1368c868badc71e1bd)\n- [Phalcon Release Tag 5.16.0](https://github.com/phalcon/cphalcon/releases/tag/v5.16.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59989) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T04:31:35.532584Z"}