Skip to content
OpenAdvisories

Product · phalcon

cphalcon

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.2
    CVE-2026-59989

    Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

    Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them thr…

    phalcon cphalcon phalcon/cphalcon Packagist