CVE-2026-59989
Critical
Description
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.
SeverityCritical
CVSS9.2
Exploit probability—
ProductPhalcon/cphalcon
PublishedAug 21, 2026
First seenAug 21, 2026
Weakness typeCWE-94Code injectionCWE-1336CWE-1336
How to fix
Update
- phalcon/cphalcon5.16.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phalcon/cphalconPackagist | v < 5.16.0 | 5.16.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.