GitHub Advisoryadvisory · Packagist

GHSA-39mm-rwm3-29jp silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template

HIGH Published 2026-08-27 Modified 2026-08-27 Official page ↗
Aliases
CVE-2026-54718
Ecosystem
Packagist
Packages
symbiote/silverstripe-advancedworkflow
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1336, CWE-20
Reviewed
2026-08-27

Affected packages

• Packagist symbiote/silverstripe-advancedworkflow: < 6.4.5 → fixed in 6.4.5 • Packagist symbiote/silverstripe-advancedworkflow: >= 7.0.0, < 7.1.3 → fixed in 7.1.3 • Packagist symbiote/silverstripe-advancedworkflow: >= 7.2.0, < 7.2.1 → fixed in 7.2.1

Description

Impact The advanced workflow email template field is vulnerable to a specially crafted payload that can be used to run arbitrary code on the server. Reported by Steve Boyd Silverstripe Ltd.

Related

Alias · CVE (1)

  • CVE-2026-54718 Silverstripe Advanced Workflow is a highly configurable step-based workflow module. vulnerability

Weakness · CWE (2)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness
  • CWE-20 Improper Input Validation weakness

References