Silverstripe Advanced Workflow CVE-2026-54718

Exploitation requires a high-privilege authenticated session in the SilverStripe CMS - specifically the ADMIN permission or a role explicitly granted the ability to create or edit advanced workflow definitions and their NotifyUsersWorkflowAction email templates. This is confirmed by the CVSS PR:H metric. The vulnerable code path is NotifyUsersWorkflowAction processing the EmailTemplate field during workflow execution. Unauthenticated users and standard CMS editor roles without workflow template access cannot exploit this vulnerability. Exploitation is further scoped to SilverStripe installations where the symbiote/silverstripe-advancedworkflow module is installed and at least one workflow includes a NotifyUsers action. No non-default configuration beyond module installation is required once admin access is obtained.

The CVSS 3.1 base score of 7.2 (High) reflects the full-host-compromise impact potential (C:H/I:H/A:H) but is substantially tempered by the PR:H requirement. Exploitation demands authenticated access with high CMS privileges - specifically the ability to create or edit advanced workflow email templates, corresponding to the SilverStripe ADMIN permission or an equivalent workflow manager role. This restricts the realistic attacker pool to insiders, compromised admin accounts, or attackers who have already achieved privilege escalation through a separate vector. The attack complexity is low (AC:L) once credentials are held, and no user interaction is required beyond the attacker's own CMS actions. No EPSS data was provided in the input, no CISA KEV listing exists, and no standalone public exploit tool has been identified; however, the PR #629 test case in the advisory explicitly documents the exact <%t %> injection syntax, meaning any analyst who reads the advisory can reconstruct the exploit. The unchanged scope (S:U) limits lateral pivot from this vector alone, but arbitrary PHP execution under the web server process typically grants access to database credentials stored in configuration files, enabling further compromise beyond the CMS. Overall risk is real and material for organizations where CMS admin access is broadly granted or poorly audited, but the PR:H gate rules out opportunistic mass-scanning exploitation.

An attacker holding CMS administrator credentials navigates to the advanced workflow email template configuration in the SilverStripe backend, enters a payload such as <%t Foo "{${'system'('id')}}" %> into the EmailTemplate field, and saves the workflow. When the workflow subsequently executes and the NotifyUsersWorkflowAction renders the template server-side, the embedded PHP expression is evaluated under the web server process, returning command output or writing attacker-controlled files to the filesystem. The PR #629 test case in the advisory documents this exact injection pattern, making reconstruction straightforward.