Phalcon Volt Compiler SSTI to RCE via join Filter

The Volt template compiler in Phalcon (cphalcon <= 5.15.0) contains a critical vulnerability (CVE-2026-59989) in the implementation of the join filter. During the compilation of Volt templates into PHP, the compiler performs direct string concatenation of raw template arguments into the generated PHP code without any escaping or neutralization. Specifically, the separator literal and the array argument are spliced verbatim into the generated join('…', …) call.

An attacker who can provide input to the Volt template rendering engine can inject arbitrary PHP instructions by breaking out of the intended function syntax. Because Phalcon writes these compiled templates to cache files and executes them via require() at render time, the injected PHP code is executed within the context of the web-server process. This allows for full remote code execution on any application utilizing an affected version of Phalcon that permits user-influenced Volt templates.

Attack Chain

1. Attacker identifies a web application utilizing Phalcon Volt where template content or specific filter arguments are influenced by user input.
2. Attacker crafts a malicious Volt template string containing a join filter call.
3. Attacker injects a payload into the join separator or array argument, such as "',[]); echo shell_exec('id'); //".
4. The Phalcon Compiler processes the template, concatenating the malicious input verbatim into the generated PHP cache file.
5. The resulting PHP file is written to the application's cache directory with the injected payload placed inside a join() function call.
6. The application calls the Volt rendering engine for the template.
7. The engine executes require() on the malicious cache file.
8. The injected payload executes, granting the attacker arbitrary code execution on the server.

Impact

Successful exploitation results in full remote code execution in the context of the web-server process. This impact is applicable to all applications using Phalcon cphalcon versions up to and including 5.15.0 where template input can be manipulated by an attacker.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Patch Phalcon cphalcon to a version after 5.15.0 to resolve CVE-2026-59989.
• Audit application code for instances where user-supplied data is passed directly into template engine rendering functions or Volt template string compilation.
• Deploy webserver logs to monitor for suspicious input in parameters that could be interpreted as template arguments.
• Implement input validation on all template-related inputs to prevent injection of template control characters or syntax breaking sequences.