Cphalcon
Monthly
Compile-time PHP code injection in the Phalcon (cphalcon) PHP framework's Volt template compiler (versions 5.15.0 and earlier) lets an attacker who can influence Volt template source achieve remote code execution. The Volt `join` filter emits the separator and array arguments as raw, unescaped bytes into the generated PHP, so quote-breaking content escapes the `join('…')` call and is written into the cached compiled template that is then require()'d at render time. Publicly available exploit code exists (a working PoC that runs shell_exec is published in the GHSA advisory); the issue is not listed in CISA KEV and no active exploitation is confirmed.
Regular-expression denial of service (ReDoS) in the Phalcon PHP framework before 5.15.0 lets remote unauthenticated attackers exhaust server CPU by sending a crafted request URI. Every default MVC application registers a built-in route whose compiled PCRE pattern contains a nested quantifier that Router::handle() evaluates against the raw request path on every request, so a path with repeated slashes followed by decoded newlines triggers catastrophic backtracking. There is no public exploit identified at time of analysis, and the CVSS 4.0 score of 8.7 reflects a high availability impact with no confidentiality or integrity effect.
Authentication-bypass via timing side-channel in Phalcon's Crypt::decrypt (cphalcon PHP framework prior to 5.14.1) allows remote attackers to forge valid HMAC tags and have tampered ciphertext accepted as authentic. Because the HMAC verification uses PHP/Zephir identity comparison that short-circuits on the first mismatching byte, an attacker who can observe response timing can recover a valid tag byte-by-byte and break the encrypt-then-MAC integrity guarantee. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is confirmed and patched by the vendor in 5.14.1.
Compile-time PHP code injection in the Phalcon (cphalcon) PHP framework's Volt template compiler (versions 5.15.0 and earlier) lets an attacker who can influence Volt template source achieve remote code execution. The Volt `join` filter emits the separator and array arguments as raw, unescaped bytes into the generated PHP, so quote-breaking content escapes the `join('…')` call and is written into the cached compiled template that is then require()'d at render time. Publicly available exploit code exists (a working PoC that runs shell_exec is published in the GHSA advisory); the issue is not listed in CISA KEV and no active exploitation is confirmed.
Regular-expression denial of service (ReDoS) in the Phalcon PHP framework before 5.15.0 lets remote unauthenticated attackers exhaust server CPU by sending a crafted request URI. Every default MVC application registers a built-in route whose compiled PCRE pattern contains a nested quantifier that Router::handle() evaluates against the raw request path on every request, so a path with repeated slashes followed by decoded newlines triggers catastrophic backtracking. There is no public exploit identified at time of analysis, and the CVSS 4.0 score of 8.7 reflects a high availability impact with no confidentiality or integrity effect.
Authentication-bypass via timing side-channel in Phalcon's Crypt::decrypt (cphalcon PHP framework prior to 5.14.1) allows remote attackers to forge valid HMAC tags and have tampered ciphertext accepted as authentic. Because the HMAC verification uses PHP/Zephir identity comparison that short-circuits on the first mismatching byte, an attacker who can observe response timing can recover a valid tag byte-by-byte and break the encrypt-then-MAC integrity guarantee. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is confirmed and patched by the vendor in 5.14.1.