Vendor
The Phalcon Volt template compiler fails to escape arguments in the join filter, allowing unauthenticated attackers to perform server-side template injection leading to remote code execution (CVE-2026-59989).