CVE-2026-88990 RCE in email template field via template execution
- Severity:
- High (?)
- Identifier:
- CVE-2026-88990
- Versions Affected:
- symbiote/silverstripe-advancedworkflow: < 6.4.6 || >= 7.0.0, < 7.2.4
- Versions Fixed:
- symbiote/silverstripe-advancedworkflow: 6.4.6, 7.2.4
- Release Date:
- 2026-10-28
The email template of an advanced workflow "Notify Users" action was rendered as a template when the action ran. A CMS user who can edit workflow definitions could use template code in this field to run code on the server.
Base CVSS: 7.2
Reported by: Jack Wallace from Bastion Security
