CVE-2026-54718
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.2
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.72%
- CWE
- CWE-1336
- Published
- 2026-08-27
- Last modified
- 2026-08-31
Affected products
- silverstripe silverstripe-advancedworkflow
- silverstripe silverstripe-advancedworkflow
- silverstripe silverstripe-advancedworkflow
Weakness type
Related vulnerabilities
- CVE-2026-19584 — Velociraptor VQL injection during notebook restore from backup
- CVE-2026-87021 — Tanium addressed an unauthorized code execution vulnerability in Comply.
- CVE-2026-33387 — Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0
- CVE-2026-75650 — Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
- CVE-2026-52762 — YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
- CVE-2026-46636 — Twig: Sandbox method allowlist bypass via `Markup` subclass
- CVE-2026-85654 — Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server
- CVE-2026-13297 — Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access