CVE-2026-54718: 
PHP vulnerability analysis and mitigation

CVE-2026-54718 is a server-side template injection vulnerability in the Silverstripe Advanced Workflow module (symbiote/silverstripe-advancedworkflow) that allows an authenticated attacker with workflow authoring permissions to achieve remote code execution (RCE) via a crafted payload in the NotifyUsersWorkflowAction.EmailTemplate field. The vulnerability was first disclosed on June 24, 2026, and published to the GitHub Advisory Database on August 27, 2026. Affected versions include all releases before 6.4.5, 7.0.0–7.1.2, and 7.2.0. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is improper neutralization of special elements used in a template engine (CWE-1336) combined with improper input validation (CWE-20). The NotifyUsersWorkflowAction.EmailTemplate field is a plain TextareaField with no escaping; when the workflow action executes, the field content is rendered directly through the Silverstripe template engine (SSTemplateParser). A specially crafted <%t %> translation tag with a PHP expression embedded in the default string argument (e.g., <%t Foo "{${'file_put_contents'('/path','pwned')}}" %>) causes the parser to evaluate the expression as PHP, resulting in arbitrary code execution on the server. The fix required bumping the dependency on silverstripe/framework to ^5.4.30 (or silverstripe/template-engine ^1.0.1 for the 7.2.x branch) to consume an upstream SSTemplateParser fix, and regression coverage was added in tests/php/WorkflowEngineTest.php (GitHub Advisory, Patch Commit #629, Patch Commit #630).

Successful exploitation grants the attacker arbitrary PHP code execution on the server with the privileges of the web application process, resulting in high confidentiality, integrity, and availability impact. An attacker can read or exfiltrate sensitive data (database credentials, application secrets), modify or delete application files, install backdoors or web shells, and potentially pivot to other systems accessible from the server. The scope is limited to the affected application instance, but the full compromise of the web server process makes lateral movement and persistent access highly feasible (GitHub Advisory).

Exploitation requires an authenticated account with permission to author or configure advanced workflow email templates, which is typically an administrator or privileged content author role — reducing the attack surface compared to unauthenticated vulnerabilities. No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS score data is not yet available for this CVE.

1. Gain privileged access: Obtain credentials for an account with permission to configure advanced workflow actions (e.g., a CMS administrator or workflow author account) through phishing, credential stuffing, or insider access.
2. Navigate to workflow configuration: Log into the Silverstripe CMS admin panel and navigate to the Advanced Workflow module configuration to locate or create a NotifyUsersWorkflowAction step.
3. Inject malicious template payload: In the EmailTemplate field, enter a crafted Silverstripe template string that embeds a PHP expression within a <%t %> translation tag, for example:

   <%t Foo "{${'file_put_contents'('/var/www/html/shell.php','<?php system($_GET[cmd]);?>')}}" %>

4. Trigger workflow execution: Save the workflow action and trigger the workflow on a content item so that NotifyUsersWorkflowAction::execute() is called, causing the template engine to render the malicious EmailTemplate field.
5. Achieve code execution: The SSTemplateParser evaluates the embedded PHP expression, writing a web shell or executing arbitrary commands on the server with the web application process's privileges (GitHub Advisory, Patch Commit #629).

• File System: Unexpected PHP files (e.g., web shells) created in the web root or assets directory by the web server process; presence of files like aw_rce_test.txt in the assets path (used in the regression test payload).
• Logs: CMS audit logs showing modification of NotifyUsersWorkflowAction email template fields by non-administrative accounts or at unusual times; PHP error logs containing template engine evaluation errors or unexpected file_put_contents/system/exec function calls.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., bash, curl, wget, python) during workflow execution events.
• Network: Outbound connections from the web server to unknown external IPs or C2 infrastructure initiated around the time a workflow notification action is triggered.

Upgrade symbiote/silverstripe-advancedworkflow to one of the patched versions: 6.4.5, 7.1.3, or 7.2.1 depending on the branch in use. The fix also requires updated upstream dependencies: silverstripe/framework ^5.4.30 (for the 7.1.x branch) or silverstripe/template-engine ^1.0.1 (for the 7.2.x branch). As an interim workaround, restrict CMS permissions so that only fully trusted administrators can create or modify advanced workflow actions, particularly the NotifyUsersWorkflowAction email template field (GitHub Advisory, Silverstripe Security Release).

The vulnerability was reported by Steve Boyd of Silverstripe Ltd. and patched internally before public disclosure, following a responsible disclosure process. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and patch commits (GitHub Advisory).