Loading vulnerability…
Phalcon Volt join filter PHP code injection
CVE-2026-59989 is a server-side template/code-injection vulnerability in Phalcon cphalcon through version 5.15.0. The Volt compiler's join-filter handling incorporates raw separator and array-token arguments into generated PHP without processing them as expressions. Quote-breaking template arguments can therefore inject arbitrary PHP into the compiled-template cache; the injected code executes when Volt renders and loads the affected template.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who can cause malicious Volt template source to be compiled can achieve arbitrary PHP execution in the context of the process rendering the template, typically the web-server or PHP runtime account. This can result in compromise of confidentiality, integrity, and availability accessible to that account.
If you can’t patch tonight, do this now.
Until upgrading, prohibit untrusted users and sources from creating or modifying Volt templates. Supply untrusted values only as rendering data, not as Volt syntax. Restrict write access to compiled-template cache directories and apply least-privilege containment to the web-server and PHP runtime account.
Patch, then assume compromise.
Upgrade Phalcon cphalcon to version 5.16.0 or later, which corrects join-filter compilation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.