{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/phalcon/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-59989"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cphalcon (\u003c= 5.15.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Phalcon"],"content_html":"\u003cp\u003eThe Volt template compiler in Phalcon (cphalcon \u0026lt;= 5.15.0) contains a critical vulnerability (CVE-2026-59989) in the implementation of the \u003ccode\u003ejoin\u003c/code\u003e filter. During the compilation of Volt templates into PHP, the compiler performs direct string concatenation of raw template arguments into the generated PHP code without any escaping or neutralization. Specifically, the separator literal and the array argument are spliced verbatim into the generated \u003ccode\u003ejoin('…', …)\u003c/code\u003e call.\u003c/p\u003e\n\u003cp\u003eAn attacker who can provide input to the Volt template rendering engine can inject arbitrary PHP instructions by breaking out of the intended function syntax. Because Phalcon writes these compiled templates to cache files and executes them via \u003ccode\u003erequire()\u003c/code\u003e at render time, the injected PHP code is executed within the context of the web-server process. This allows for full remote code execution on any application utilizing an affected version of Phalcon that permits user-influenced Volt templates.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a web application utilizing Phalcon Volt where template content or specific filter arguments are influenced by user input.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious Volt template string containing a \u003ccode\u003ejoin\u003c/code\u003e filter call.\u003c/li\u003e\n\u003cli\u003eAttacker injects a payload into the \u003ccode\u003ejoin\u003c/code\u003e separator or array argument, such as \u003ccode\u003e\u0026quot;',[]); echo shell_exec('id'); //\u0026quot;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Phalcon \u003ccode\u003eCompiler\u003c/code\u003e processes the template, concatenating the malicious input verbatim into the generated PHP cache file.\u003c/li\u003e\n\u003cli\u003eThe resulting PHP file is written to the application's cache directory with the injected payload placed inside a \u003ccode\u003ejoin()\u003c/code\u003e function call.\u003c/li\u003e\n\u003cli\u003eThe application calls the Volt rendering engine for the template.\u003c/li\u003e\n\u003cli\u003eThe engine executes \u003ccode\u003erequire()\u003c/code\u003e on the malicious cache file.\u003c/li\u003e\n\u003cli\u003eThe injected payload executes, granting the attacker arbitrary code execution on the server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution in the context of the web-server process. This impact is applicable to all applications using Phalcon cphalcon versions up to and including 5.15.0 where template input can be manipulated by an attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Phalcon cphalcon to a version after 5.15.0 to resolve CVE-2026-59989.\u003c/li\u003e\n\u003cli\u003eAudit application code for instances where user-supplied data is passed directly into template engine rendering functions or Volt template string compilation.\u003c/li\u003e\n\u003cli\u003eDeploy webserver logs to monitor for suspicious input in parameters that could be interpreted as template arguments.\u003c/li\u003e\n\u003cli\u003eImplement input validation on all template-related inputs to prevent injection of template control characters or syntax breaking sequences.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T01:16:48Z","date_published":"2026-08-22T01:16:48Z","id":"https://feed.craftedsignal.io/briefs/2026-08-phalcon-volt-rce/","summary":"The Phalcon Volt template compiler fails to escape arguments in the join filter, allowing unauthenticated attackers to perform server-side template injection leading to remote code execution (CVE-2026-59989).","title":"Phalcon Volt Compiler SSTI to RCE via join Filter","url":"https://feed.craftedsignal.io/briefs/2026-08-phalcon-volt-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Phalcon","version":"https://jsonfeed.org/version/1.1"}