{"uuid": "a357fccf-23a0-4e3f-b5d8-01101423f13a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-54718", "type": "seen", "source": "https://gist.github.com/alon710/bec19cdcf2926727440026551fd338c7", "content": "# CVE-2026-54718: CVE-2026-54718: Remote Code Execution via Advanced Workflow Email Template in Silverstripe\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54718\n\n## Summary\nA Server-Side Template Injection (SSTI) vulnerability in the Silverstripe Advanced Workflow module allows authenticated attackers with workflow authoring permissions to achieve arbitrary code execution. By manipulating the NotifyUsersWorkflowAction.EmailTemplate field, attackers can inject template code that dynamically executes arbitrary PHP commands via the core translation helper interpolation path.\n\n## TL;DR\nAn authenticated template injection vulnerability in Silverstripe Advanced Workflow allows high-privileged users to achieve Remote Code Execution via translation tag interpolation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1336\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.2 (High)\n- **EPSS Score**: N/A (Recently Disclosed)\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: PoC Available in Regression Tests\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Silverstripe CMS installations utilizing Advanced Workflow module (< 6.4.5, 7.x < 7.1.3, 7.2.x < 7.2.1)\n- **silverstripe-advancedworkflow**: < 6.4.5 (Fixed in: `6.4.5`)\n- **silverstripe-advancedworkflow**: >= 7.0.0, < 7.1.3 (Fixed in: `7.1.3`)\n- **silverstripe-advancedworkflow**: >= 7.2.0, < 7.2.1 (Fixed in: `7.2.1`)\n\n## Mitigation\n\n- Upgrade Silverstripe core packages to versions incorporating the hardened template parser engine.\n- Restrict raw web-writable execution patterns inside standard public directories.\n- Deploy Web Application Firewall rules targeting translation-tag nesting structures.\n\n**Remediation Steps:**\n1. Navigate to the root directory of the Silverstripe project.\n2. Run 'composer update silverstripe/framework silverstripe/template-engine symbiote/silverstripe-advancedworkflow'.\n3. Verify that silverstripe/template-engine is version 1.0.1 or higher (v6 projects) or silverstripe/framework is 5.4.30 or higher (v5 projects).\n4. Rebuild the template manifest using 'sake dev/build' or '?flush=all' in the browser.\n\n## References\n\n- [GitHub Security Advisory GHSA-39mm-rwm3-29jp](https://github.com/silverstripe/silverstripe-advancedworkflow/security/advisories/GHSA-39mm-rwm3-29jp)\n- [Pull Request #629](https://github.com/silverstripe/silverstripe-advancedworkflow/pull/629)\n- [Pull Request #630](https://github.com/silverstripe/silverstripe-advancedworkflow/pull/630)\n- [Silverstripe Core Security Bulletin CVE-2026-54718](https://www.silverstripe.org/download/security-releases/cve-2026-54718)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54718) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-27T20:32:16.461677Z"}