Critical
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)
Type: advisorySources: OSV
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-59989
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 15:12 UTC · Revision 1
Source evidence
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)
core-osv · Original sourcePublished 21 Aug 2026, 20:25 UTC
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.
osv:CVE-2026-59989
Complete source record
{
"id": "cac64e50c35d32384f63d68796cfc1ad833dbcff4361cbb4c007189297aa8cd6",
"url": "https://osv.dev/vulnerability/CVE-2026-59989",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)",
"summary": "Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\\Mvc\\View\\Engine\\Volt::render() loads the template. This issue is fixed in version 5.16.0.",
"evidence": "osv:CVE-2026-59989",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-59989",
"aliases": [
"CVE-2026-59989",
"GHSA-hrwp-4hh9-c8r8"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/phalcon/cphalcon",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b9e8cc906fe64667013fcc8aa26e154c48fa2947"
},
{
"fixed": "e434061be3b7161930476c1368c868badc71e1bd"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.16.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "e434061be3b7161930476c1368c868badc71e1bd"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b9e8cc906fe64667013fcc8aa26e154c48fa2947"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v5.16.0"
}
]
}
}
],
"versions": [
"v5.15.0",
"v5.14.2",
"v5.14.1",
"v5.14.0",
"v5.13.0",
"v5.12.1",
"5.12.0",
"v5.11.1",
"v5.11.0",
"v5.10.0",
"v5.9.3",
"v5.9.2",
"v5.9.1",
"v5.9.0",
"v5.8.0",
"v5.7.0",
"v5.6.2",
"v5.6.1",
"v5.6.0",
"v5.5.0",
"v5.4.0",
"v5.3.1",
"v5.3.0",
"v5.2.3",
"v5.2.2",
"v5.2.1",
"v5.2.0",
"v5.1.4",
"v5.1.3",
"v5.1.2",
"v5.1.1",
"v5.1.0",
"v5.0.5",
"v5.0.4",
"v5.0.3",
"v5.0.2",
"v5.0.1",
"v5.0.0",
"v5.0.0RC4",
"v5.0.0RC3",
"v5.0.0RC2",
"v5.0.0RC1",
"v5.0.0beta3",
"v5.0.0beta2",
"v5.0.0beta1",
"v5.0.0alpha7",
"v5.0.0alpha6",
"v5.0.0alpha5",
"v5.0.0alpha4",
"v5.0.0alpha3",
"5.0.0alpha3",
"v5.0.0-alpha.2",
"v5.0.0-alpha.1",
"v4.1.0",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.3",
"v4.0.2",
"v4.0.1",
"v4.0.0",
"v4.0.0-rc.3",
"v4.0.0-rc.2",
"v4.0.0-rc.1",
"v4.0.0-beta.2",
"v4.0.0-beta.1",
"v4.0.0-alpha.5",
"v4.0.0-alpha.3",
"v4.0.0-alpha.2",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.4",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"phalcon-v2.0.13",
"phalcon-v2.0.11",
"phalcon-v2.0.10",
"phalcon-v2.0.9",
"phalcon-v2.0.8",
"phalcon-v2.0.7",
"phalcon-v2.0.6",
"phalcon-v2.0.5",
"phalcon-v2.0.4",
"phalcon-v2.0.3",
"phalcon-v2.0.2",
"phalcon-v2.0.1",
"phalcon-v2.0.0",
"phalcon-v1.3.4",
"phalcon-v1.3.3",
"phalcon-v1.3.2",
"phalcon-v1.3.1",
"phalcon-v1.3.0",
"v1.2.0",
"phalcon-v1.2.0",
"v1.1.0",
"phalcon-v1.1.0",
"v1.0.1",
"phalcon-v1.0.1",
"v1.0.0",
"phalcon-v1.0.0",
"v0.9.0",
"phalcon-v0.9.0",
"v0.7.0",
"phalcon-v0.7.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59989.json"
}
}
],
"modified": "2026-10-28T02:30:29.917899366Z",
"provider": "osv",
"references": [
"https://github.com/phalcon/cphalcon/releases/tag/v5.16.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59989.json",
"https://github.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8",
"https://nvd.nist.gov/vuln/detail/CVE-2026-59989",
"https://github.com/phalcon/cphalcon/commit/e434061be3b7161930476c1368c868badc71e1bd",
"https://github.com/phalcon/cphalcon/pull/17217"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1336",
"CWE-94"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59989.json"
}
},
"related_cves": [
{
"value": "CVE-2026-59989",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 496705,
"published_at": "2026-08-21T20:25:44.767+00:00"
}