Vulnerabilities

TI-2026-42773 CVE-2026-59989 · GHSA-hrwp-4hh9-c8r8

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

HIGH 81

Phalcon is a high-performance, full-stack PHP framework.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00543 Published 2026-08-21 Fixed in 5.16.0 CWE-1336

TI-2026-41434 CVE-2026-57584 · GHSA-x7rj-f32v-7jjg

HIGH 77

Phalcon is a high-performance, full-stack PHP framework.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00532 Published 2026-07-10 Fixed in 5.15.0 CWE-1333

TI-2026-39548 CVE-2026-54736 · GHSA-8jqh-95g6-7jpj

LOW 35

Phalcon is a high-performance, full-stack PHP framework.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0018 Published 2026-07-10 Fixed in 5.14.1 CWE-208