CVE-2026-54718: Silverstripe Advanced Workflow RCE in email template

CVE-2026-54718 · Severity: high · CVSS 7.2 · Published 2026-08-27

Silverstripe Advanced Workflow is a plugin that automates document routing and approvals in the Silverstripe CMS. An authenticated admin user can inject malicious code through the workflow email template field, leading to complete server compromise. This allows an attacker to read sensitive data, modify application logic, or take the system offline entirely.

Vendors: Packagist, Silverstripe.

Quick answers

Is CVE-2026-54718 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54718 being exploited in the wild.
How severe is CVE-2026-54718?
High severity, with a CVSS score of 7.2, published 27 August 2026.
Which products and versions are affected?
symbiote/silverstripe-advancedworkflow (Packagist) ECOSYSTEM:introduced=0,fixed=6.4.5; Silverstripe Advanced Workflow < 6.4.5, >= 7.0.0 < 7.1.3, >= 7.2.0 < 7.2.1.
Is there a fix for CVE-2026-54718?
Yes. symbiote/silverstripe-advancedworkflow (Packagist): upgrade to 6.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54718 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54718?
Check whether you run symbiote/silverstripe-advancedworkflow (Packagist) or Silverstripe Advanced Workflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symbiote/silverstripe-advancedworkflow (Packagist): upgrade to 6.4.5 or later
    composer require symbiote/silverstripe-advancedworkflow:^6.4.5

Technical details

The vulnerability exists in the advanced workflow email template field, which suffers from improper input validation and inadequate neutralization of special template engine syntax (CWE-20, CWE-1336). An authenticated user with high-level privileges can craft a payload containing template directives or code expressions that are processed by the template engine without proper sanitization. When the workflow triggers email notifications, the malicious payload is evaluated server-side, resulting in arbitrary code execution with the privileges of the web server process. The attack requires authenticated access with administrative or workflow configuration permissions but no user interaction once the payload is planted. Patches are available in versions 6.4.5, 7.1.3, and 7.2.1.

Affected products

  • Silverstripe Advanced Workflow < 6.4.5, >= 7.0.0 < 7.1.3, >= 7.2.0 < 7.2.1

Identifiers

  • CVE-2026-54718
  • GHSA-39mm-rwm3-29jp

Timeline

  • 2026-06-24: disclosed: Vulnerability initially published in GitHub Advisory Database
  • 2026-06-24: patched: Patches released for versions 6.4.5, 7.1.3, and 7.2.1
  • 2026-08-27: advisory: Advisory updated and published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.