Phalcon vulnerabilities

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.

A vulnerability in Phalcon before version 5.15.0 causes the default MVC router to use a compiled PCRE pattern with a nested quantifier, allowing an attacker to trigger catastrophic backtracking via a crafted request URI containing repeated slashes and newline characters. This leads to CPU exhaustion or route-matching failure.

A vulnerability in Phalcon before version 5.14.1 allows an attacker to exploit a timing side-channel in the Phalcon\Encryption\Crypt::decrypt function, where the HMAC comparison is performed byte-by-byte and returns early on the first mismatch. This enables the attacker to recover a valid HMAC tag byte-by-byte and attach it to a chosen IV and ciphertext, causing decrypt() to accept tampered encrypted content as authentic.