PT-2026-79456

CVE-2026-59989

Published

2026-08-21

Updated

2026-10-12

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Phalcon versions prior to 5.16.0

Description The resolveFilter function in phalcon/Mvc/View/Engine/Volt/Compiler.zep constructs the join filter by inserting raw separator and array token values into generated PHP without using the expression() function. An attacker capable of influencing the Volt template source can use quote-breaking content in a join argument to inject PHP into the compiled cache file, which is then executed when PhalconMvcViewEngineVolt::render() loads the template.

Recommendations Update to version 5.16.0.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers

CVE-2026-59989