SS-2026-007 RCE via template string escaping in advanced workflow email template

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

Severity:: High (?)
Identifier:: SS-2026-007
Versions Affected:: symbiote/silverstripe-advancedworkflow: < 6.4.6 || >= 7.0.0, < 7.2.4
Versions Fixed:: symbiote/silverstripe-advancedworkflow: 6.4.6, 7.2.4
Release Date:: 2026-10-28

The email template of an advanced workflow "Notify Users" action was rendered as a template when the action ran. A CMS user who can edit workflow definitions could use crafted template code in this field to run code on the server.

Base CVSS: 7.2
Reported by: Steve Boyd, Silverstripe Ltd.