Phalcon (cphalcon) EUVD-2026-64140

The concrete prerequisite is that the attacker must be able to influence the source of a Volt template that the application compiles - specifically the arguments passed to the Volt join filter - since those separator and array token bytes are emitted into generated PHP without escaping. Exploitation is limited by the fact that most Phalcon applications use static, developer-authored Volt templates that no attacker can modify; the flaw is only reachable where template source (or the data spliced into a join argument literal) is attacker-controllable, which is reflected by AT:P (Attack Requirements: Present) in the CVSS 4.0 vector. No authentication is required per the vector (PR:N) and no user interaction (UI:N), but the non-default requirement of attacker-influenced template content is the decisive limiting factor.

The CVSS 4.0 base score is 9.2 (Critical) with vector AV:N/AC:L/AT:P/PR:N/UI:N and full High impact to confidentiality, integrity, and availability of the vulnerable system, reflecting arbitrary PHP execution. The single most important signal is AT:P (Attack Requirements: Present) - exploitation is NOT unconditional: the attacker must be able to influence Volt template source, which is not the case for the common deployment pattern where templates are static and developer-authored. A publicly available PoC exists, raising practical risk, but there is no CISA KEV listing and no confirmed active exploitation, so this is a serious-but-conditional issue rather than a confirmed mass-exploitation event. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. Bottom line: high priority to patch for any application that compiles user-supplied or otherwise attacker-influenceable Volt templates; lower urgency for applications where all Volt sources are trusted and static, though patching remains strongly advised as defense in depth.

An application allows users to supply or influence Volt template fragments (for example a themable email/report builder or a CMS that lets editors write Volt snippets). The attacker submits a template using the join filter such as {{ ['x'] | join("',[]); echo shell_exec(base64_decode('...')); //") }}, which breaks out of the generated join('…') call. When Phalcon compiles and renders the template, the injected PHP is written to the cache file and executed via require(), running attacker commands on the server - exactly as demonstrated by the published PoC.