CVE-2026-59989

UNKNOWN 0.0

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.

CWE	CWE-94 CWE-1336
Vendor	phalcon
Product	cphalcon
Published	Aug 21, 2026

Stay Ahead of the Next One

Get instant alerts for phalcon cphalcon

Be the first to know when new unknown vulnerabilities affecting phalcon cphalcon are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

phalcon / cphalcon

< 5.16.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8 github.com: https://github.com/phalcon/cphalcon/pull/17217 github.com: https://github.com/phalcon/cphalcon/commit/e434061be3b7161930476c1368c868badc71e1bd github.com: https://github.com/phalcon/cphalcon/releases/tag/v5.16.0