CVE-2026-54718
Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.
- Record
CVE-2026-54718- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
EUVDEUVD-2026-67160
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.
- Record
EUVD-2026-67160- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-39mm-rwm3-29jp
silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template
Impact
The advanced workflow email template field is vulnerable to a specially crafted payload that can be used to run arbitrary code on the server.
Reported by
Steve Boyd Silverstripe Ltd.
- Record
GHSA-39mm-rwm3-29jp- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-1336
- Updated
- 2026-11-02
NVD
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.
- Record
CVE-2026-54718- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSV
Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.
- Record
CVE-2026-54718- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSVGHSA-39mm-rwm3-29jp
silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template
Impact
The advanced workflow email template field is vulnerable to a specially crafted payload that can be used to run arbitrary code on the server.
Reported by
Steve Boyd Silverstripe Ltd.
- Record
GHSA-39mm-rwm3-29jp- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1336, CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symbiote/silverstripe-advancedworkflowPackagist |
before 6.4.5 | 6.4.5 |
symbiote/silverstripe-advancedworkflowPackagist |
7.0.0 up to 7.1.3 | 7.1.3 |
symbiote/silverstripe-advancedworkflowPackagist |
7.2.0 up to 7.2.1 | 7.2.1 |
symbiote/silverstripe-advancedworkflowPackagist |
before 6.4.5, plus listed versions 2.1.03.0.13.0.1-rc13.0.23.0.3 Show 45 moreShow less3.0.43.0.53.0.63.1.03.1.13.1.23.1.33.2.03.2.13.2.23.2.33.3.03.3.13.3.23.3.33.4.03.5.03.6.03.6.13.7.03.7.13.7.23.8.03.8.13.8.23.9.03.9.14.0.04.0.14.1.04.2.05.0.05.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.85.1.05.1.15.1.25.2.05.2.1 |
6.4.5 |
symbiote/silverstripe-advancedworkflowPackagist |
7.0.0 up to 7.1.3, plus listed versions 7.0.17.0.27.1.07.1.0-beta17.1.0-rc17.1.17.1.2 |
7.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54718 is a high vulnerability (CVSS 7.2) in Silverstripe Silverstripe-advancedworkflow, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in symbiote/silverstripe-advancedworkflow 6.4.5.
References
github.com/silverstripe/silverstripe-advancedworkflow/security/advisories/GHSA-39mm-rwm3-29jp
Show 8 moreShow less
silverstripe.org/download/security-releases/cve-2026-54718
nvd.nist.gov/vuln/detail/CVE-2026-54718
Left out here: 60 versions. The JSON record has them.