CVE Intelligence
Analysis AI-assisted

CVE-2026-59989: Phalcon Cphalcon Volt join filter code injection (CWE-94)

The Volt template compiler in Phalcon Cphalcon inserts raw join filter separator and array token values into generated PHP without expression handling, enabling code injection (CWE-94). The record rates it CVSS 4.0 9.2 (critical) and states the issue is fixed in 5.16.0. The record does not show confirmed active exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a code injection weakness (CWE-94) in the join filter of the Volt template compiler in Phalcon Cphalcon. According to the description, the compiler places raw separator and array token values into generated PHP without passing them through expression(). The primary advisory is the GitHub Security Advisory GHSA-hrwp-4hh9-c8r8.

Impact

The description states that an attacker who can influence Volt template source can place quote-breaking content in a join argument, which is written into the compiled cache file and executed when the template is rendered. The record's CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality, integrity and availability impact on the vulnerable system, and the score is 9.2.

Affected products and versions

  • Phalcon Cphalcon: the affected range in the record is before 5.16.0. The description states the issue affects 5.15.0 and earlier.
  • Fixed version: the description states the issue is fixed in 5.16.0. The record's fixes list is empty, so the fix version is taken from the description and the linked v5.16.0 release.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. The record's SSVC exploitation field is set to poc, and its automatable field is yes. The EPSS probability is 0.00543 with a percentile of 0.44845.

Remediation and mitigation

  • Upgrade Phalcon Cphalcon to 5.16.0 or a later release that includes the fix.
  • Until the upgrade is applied, limit who can create or modify Volt template sources, and treat template content as code under review.
  • After upgrading, clear the Volt compiled cache so that templates are recompiled with the fixed compiler. This step is an inference from the description, not a stated vendor instruction.

Detection guidance

  • Review Volt templates for join filter usage where separators or array values come from untrusted input.
  • Monitor the Volt compiled cache directory for unexpected new or modified files, and compare them against the expected template set.
  • Keep change logs for template deployments so that unauthorized template edits can be traced.

Limitations of the available information

  • The record does not include proof-of-concept details, and the exploitation conditions depend on how each application loads templates.
  • The record's source status is Deferred, and its fixes list is empty.
  • The sources consulted do not show whether any deployments have been targeted.

Frequently asked questions

Which Phalcon versions are affected by CVE-2026-59989?

The description states that version 5.15.0 and earlier are affected, and the record's affected range is before 5.16.0.

Which version fixes this issue?

The description states that the issue is fixed in version 5.16.0. The record's fixes list is empty, so the release page is the reference for confirming the fix.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in this record, and no confirmed active exploitation appears in the sources consulted.

What should administrators do now?

Upgrade Phalcon Cphalcon to 5.16.0 or later, restrict who can modify Volt templates, and clear the compiled Volt cache after upgrading.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.