Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

SS-2026-002 Template injection RCE in advanced workflow

SS-2026-002 Template injection RCE in advanced workflow

Severity:
High (?)
Identifier:
SS-2026-002
Versions Affected:
symbiote/silverstripe-advancedworkflow: < 6.4.6 || >= 7.0.0, < 7.2.4
Versions Fixed:
symbiote/silverstripe-advancedworkflow: 6.4.6, 7.2.4
Release Date:
2026-10-28

The email template of an advanced workflow "Notify Users" action was rendered as a template when the action ran. A CMS user who can edit workflow definitions could use template code in this field to perform privileged actions or to run code on the server.

Base CVSS: 7.2
Reported by: Lachlan Davidson, Carapace