Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 Silverstripe Advanced Workflow, Remote Code Execution (RCE), #CVE-2026-54718 (High) -DC-Aug2026-1967 https://dailycve.com/silverstripe-advanced-workflow-remote-code-execution-rce-cve-2026-54718-high-dc-aug2026-1967/
Post summary
The post announces a newly reported Remote Code Execution vulnerability (CVE‑2026‑54718) in Silverstripe Advanced Workflow, labeling it as high severity.