What is the CVSS score of CVE-2026-54718?

CVE-2026-54718 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Silverstripe Advanced Workflow are affected by CVE-2026-54718?

Silverstripe Advanced Workflow module contains a remote code execution vulnerability enabling authenticated administrators to execute arbitrary PHP code on servers.. A patch is available.

Is there a public PoC exploit available for CVE-2026-54718?

Yes, a public proof-of-concept exploit is available for CVE-2026-54718. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-54718?

Within 24 hours, inventory all systems running symbiote/silverstripe-advancedworkflow and document current versions. Within 7 days, apply vendor patches by upgrading to version 6.4.5 (for 6.x line), 7.1.3 (for 7.1.x line), or 7.2.1 (for 7.2.x line), test thoroughly in staging, and deploy to production. Within 30 days, audit CMS administrator account permissions and implement additional controls such as IP whitelisting or enhanced multi-factor authentication for administrative access to minimize insider risk.

Silverstripe Advanced Workflow CVE-2026-54718

EUVD-2026-67160 HIGH

Improper Input Validation (CWE-20)

2026-08-27 https://github.com/silverstripe/silverstripe-advancedworkflow

GHSA-39mm-rwm3-29jp

RCE

7.2

CVSS 3.1 · Vendor: https://github.com/silverstripe/silverstripe-advancedworkflow

Severity by source

Vendor (https://github.com/silverstripe/silverstripe-advancedworkflow) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

AV:N for web-accessible CMS interface; PR:H because admin-level workflow template editing access is required; arbitrary PHP execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/silverstripe/silverstripe-advancedworkflow).

CVSS VectorVendor: https://github.com/silverstripe/silverstripe-advancedworkflow

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 27, 2026 - 18:10 vuln.today

Analysis Generated

Aug 27, 2026 - 18:10 vuln.today

CVE Published

Aug 27, 2026 - 17:20 github-advisory

HIGH 7.2

DescriptionCVE.org

Impact

The advanced workflow email template field is vulnerable to a specially crafted payload that can be used to run arbitrary code on the server.

Reported by

Steve Boyd Silverstripe Ltd.

AnalysisAI

Remote code execution in the Silverstripe Advanced Workflow module allows high-privileged authenticated CMS users to execute arbitrary PHP on the server by injecting a crafted payload into the workflow email template field. The vulnerability affects the symbiote/silverstripe-advancedworkflow Composer package across three version lines, with patches released as 6.4.5, 7.1.3, and 7.2.1. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a high-privilege authenticated session in the SilverStripe CMS - specifically the `ADMIN` permission or a role explicitly granted the ability to create or edit advanced workflow definitions and their `NotifyUsersWorkflowAction` email templates. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.2 (High) reflects the full-host-compromise impact potential (C:H/I:H/A:H) but is substantially tempered by the PR:H requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade the `symbiote/silverstripe-advancedworkflow` Composer package to the patched release for your installed branch: 6.4.5 for the 6.x line (https://github.com/silverstripe/silverstripe-advancedworkflow/releases/tag/6.4.5), 7.1.3 for the 7.1.x line (https://github.com/silverstripe/silverstripe-advancedworkflow/releases/tag/7.1.3), or 7.2.1 for the 7.2.x line (https://github.com/silverstripe/silverstripe-advancedworkflow/releases/tag/7.2.1). … Detailed patch versions, workarounds, and compensating controls in full report.