CVE-2026-59989

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59989
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59989.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59989
Aliases
Published
2026-08-21T20:25:44.767Z
Modified
2026-08-23T03:49:34.786663685Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)
Details

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.

Database specific 
{
    "cwe_ids": [
        "CWE-1336",
        "CWE-94"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59989.json"
}
References

Affected packages

Git / github.com/phalcon/cphalcon

Affected ranges

Type
GIT
Repo
https://github.com/phalcon/cphalcon
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e434061be3b7161930476c1368c868badc71e1bd
Fixed
b9e8cc906fe64667013fcc8aa26e154c48fa2947
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.16.0"
        }
    ]
}

Affected versions

5.*
5.0.0alpha3
5.12.0
phalcon-v0.*
phalcon-v0.7.0
phalcon-v0.9.0
phalcon-v1.*
phalcon-v1.0.0
phalcon-v1.0.1
phalcon-v1.1.0
phalcon-v1.2.0
phalcon-v1.3.0
phalcon-v1.3.1
phalcon-v1.3.2
phalcon-v1.3.3
phalcon-v1.3.4
phalcon-v2.*
phalcon-v2.0.0
phalcon-v2.0.1
phalcon-v2.0.10
phalcon-v2.0.11
phalcon-v2.0.13
phalcon-v2.0.2
phalcon-v2.0.3
phalcon-v2.0.4
phalcon-v2.0.5
phalcon-v2.0.6
phalcon-v2.0.7
phalcon-v2.0.8
phalcon-v2.0.9
v0.*
v0.7.0
v0.9.0
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.2.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.2.1
v3.2.2
v4.*
v4.0.0
v4.0.0-alpha.2
v4.0.0-alpha.3
v4.0.0-alpha.5
v4.0.0-beta.1
v4.0.0-beta.2
v4.0.0-rc.1
v4.0.0-rc.2
v4.0.0-rc.3
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.1.0
v5.*
v5.0.0
v5.0.0-alpha.1
v5.0.0-alpha.2
v5.0.0RC1
v5.0.0RC2
v5.0.0RC3
v5.0.0RC4
v5.0.0alpha3
v5.0.0alpha4
v5.0.0alpha5
v5.0.0alpha6
v5.0.0alpha7
v5.0.0beta1
v5.0.0beta2
v5.0.0beta3
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.10.0
v5.11.0
v5.11.1
v5.12.1
v5.13.0
v5.14.0
v5.14.1
v5.14.2
v5.15.0
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.3.0
v5.3.1
v5.4.0
v5.5.0
v5.6.0
v5.6.1
v5.6.2
v5.7.0
v5.8.0
v5.9.0
v5.9.1
v5.9.2
v5.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59989.json"