---
id: CVE-2026-59989
title: 'Phalcon is a high-performance, full-stack PHP framework'
summary: >-
  Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and
  earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the
  join filter by inserting the raw separator and array token values into
  generated PHP wi…
severity: critical
cwe:
  - CWE-94
  - CWE-1336
vendor: phalcon
product: phalcon/cphalcon
affected:
  - phalcon/cphalcon <= 5.15.0
patched:
  - phalcon/cphalcon 5.16.0
published: '2026-08-21'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T16:10:00.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59989'
references:
  - url: >-
      https://github.com/phalcon/cphalcon/commit/e434061be3b7161930476c1368c868badc71e1bd
    label: security-advisories@github.com
  - url: 'https://github.com/phalcon/cphalcon/pull/17217'
    label: security-advisories@github.com
  - url: 'https://github.com/phalcon/cphalcon/releases/tag/v5.16.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-hrwp-4hh9-c8r8'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00543
epssPercentile: 0.45407
aliases:
  - GHSA-hrwp-4hh9-c8r8
ecosystem: composer
ingestedAt: '2026-08-21T21:22:19.547Z'
---

## Overview

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-59989)

Affected packages:

- `phalcon/cphalcon <= 5.15.0`

Patched in:

- `phalcon/cphalcon 5.16.0`

Source: https://github.com/advisories/GHSA-hrwp-4hh9-c8r8