Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-59989 – Remote Code Execution via Server-Side Template Injection – Phalcon (cphalcon) < 5.1

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-59989 is a critical server-side template injection (SSTI) vulnerability in the Volt template compiler of the Phalcon PHP framework (cphalcon). The flaw resides in the join filter, which embeds unescaped template arguments directly into generated PHP code, allowing an attacker who controls template source content to break out of the compiler’s string context and inject arbitrary PHP that executes when the compiled template is rendered. The vulnerability is rated 9.2 (Critical) and is remotely exploitable with no privileges or user interaction required.

Technical details

  • Root cause: The Volt compiler’s join filter handler (in Compiler.zep) constructs the compiled PHP call by directly concatenating the separator literal and the piped array argument between single quotes, without escaping either value — e.g. producing join('<separator>', <array>) verbatim.
  • Trigger conditions: An attacker must be able to influence content that is compiled as a Volt template (e.g., user-controlled input reflected into a template string, user-supplied templates, or template fragments stored and later rendered). By crafting a separator or array argument that breaks out of the emitted single quotes, the attacker can inject arbitrary PHP statements into the compiled cache file.
  • Attack vector: Network — exploitation requires no authentication or user interaction beyond the application compiling and rendering attacker-influenced template content.
  • Impact: Full remote code execution in the context of the web server/PHP process once the malicious compiled template is executed, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected application and host.

Affected software

  • Phalcon (cphalcon) versions ≤ 5.15.0 (all versions prior to 5.16.0)
  • Fixed in Phalcon 5.16.0

Severity

  • CVSS Score: 9.2 (Critical)
  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • CWE-94: Improper Control of Generation of Code (‘Code Injection’)
  • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Mitigation and recommended actions

  • Immediate: Upgrade Phalcon (cphalcon) to version 5.16.0 or later, which fixes the unescaped join filter argument handling in the Volt compiler.
  • If immediate patching is not possible:
    • Audit applications for any Volt templates that incorporate user-controlled input into join filter arguments (separator or array values) and remove or strictly sanitize such input.
    • Avoid compiling or rendering templates built from untrusted or user-supplied content.
    • Clear and regenerate any existing Volt compiled template cache files after patching, since previously compiled malicious templates could persist as cached PHP code.
    • Restrict file system write access to template cache directories to reduce the impact of any residual injected code.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge