Phalcon Volt `join` Filter Flaw Enabled PHP Code Injection and Possible RCE

Phalcon disclosed and fixed a high-severity vulnerability in the Volt template compiler that allowed compile-time PHP code injection through the join filter, later tracked as CVE-2026-59989. In affected cphalcon versions earlier than 5.16.0, Phalcon\Mvc\View\Engine\Volt\Compiler::resolveFilter() inserted raw separator and array token values directly into generated PHP instead of safely compiling them with expression(). A crafted separator containing a quote could break out of the generated join() call, inject arbitrary PHP into the compiled template cache, and execute when Phalcon\Mvc\View\Engine\Volt::render() loaded the view, creating an SSTI-to-RCE path in environments where attackers can influence Volt template source.

The fix shipped in Phalcon Framework v5.16.0 and updates the compiler to emit both join arguments through expression(), with accompanying tests and changelog entries in the related pull request and commit history. The same release also included other security-relevant hardening, including fixes for catastrophic backtracking in router pattern compilation, infinite recursion during ORM hydration via model setters, improper $_REQUEST blacklist handling in Phalcon\Support\Debug, and stricter callback handling in Phalcon\Tag\Select::selectField(). The Volt issue is particularly significant for multi-tenant CMS, dashboard, and templating scenarios because successful exploitation could lead to arbitrary code execution in the web server process.