CVE-2026-54718
HighCVSS 7.2Summary
Silverstripe Advanced Workflow, prior to 6.4.5, 7.1.3, and 7.2.1, has a vulnerability in the email template module. An attacker with permission to author email templates can place a specially crafted payload in NotifyUsersWorkflowAction.EmailTemplate, leading to PHP evaluation and arbitrary code execution on the server. Fixed in versions 6.4.5, 7.1.3, and 7.2.1.
Risk Assessment
The risk includes remote code execution by a privileged user, potentially leading to full server and data compromise.
Recommendation
It is recommended to upgrade Silverstripe Advanced Workflow to version 6.4.5, 7.1.3, or 7.2.1 or later.
Original NVD description (English source)
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.