CVE-2026-59989: CWE-94: Improper Control of Generation of Code ('Code Injection') in phalcon cphalcon

Phalcon's Volt template engine in versions 5.15.0 and earlier contains a code injection vulnerability (CWE-94) in the resolveFilter function located in phalcon/Mvc/View/Engine/Volt/Compiler.zep. The function builds join filters by directly inserting raw separator and array token values into generated PHP code without passing them through the expression() sanitization method. An attacker able to influence Volt template source can inject quote-breaking content into join arguments, resulting in arbitrary PHP code injection into the compiled cache file. This code executes when Phalcon\Mvc\View\Engine\Volt::render() loads the template. The vulnerability is resolved in version 5.16.0.

Successful exploitation allows an attacker with the ability to modify Volt template source to execute arbitrary PHP code on the server, leading to full compromise of the application environment. The CVSS 4.0 score is 9.2 (critical), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade Phalcon to version 5.16.0 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 5.16.0.