CVE-2026-54718: Silverstripe Silverstripe-Advancedworkflow

High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days.

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.

Affected products

• Silverstripe Silverstripe-Advancedworkflow: before 6.4.5 (fixed in 6.4.5); from 7.0.0, before 7.1.3 (fixed in 7.1.3); from 7.2.0, before 7.2.1 (fixed in 7.2.1)

Published 2026-08-27. Last modified 2026-09-09.