Answer in brief
CVE-2026-54718 records a High severity (CVSS 7.2) vulnerability in Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template. The current sources do not mark it as known exploited. The current feed maps symbiote/silverstripe-advancedworkflow (composer), symbiote/silverstripe-advancedworkflow (composer), symbiote/silverstripe-advancedworkflow (composer), silverstripe/silverstripe-advancedworkflow (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps symbiote/silverstripe-advancedworkflow (composer), symbiote/silverstripe-advancedworkflow (composer), symbiote/silverstripe-advancedworkflow (composer), silverstripe/silverstripe-advancedworkflow (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| symbiote/silverstripe-advancedworkflowcomposer | <6.4.5 | 6.4.5 |
| symbiote/silverstripe-advancedworkflowcomposer | >=7.0.0,<7.1.3 | 7.1.3 |
| symbiote/silverstripe-advancedworkflowcomposer | >=7.2.0,<7.2.1 | 7.2.1 |
| silverstripe/silverstripe-advancedworkflowgeneric | < 6.4.5 || >= 7.0.0, < 7.1.3 || >= 7.2.0, < 7.2.1 | Not reported |
Published upstream
Aug 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 27, 2026
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.
Quoted source text, attributed separately from HOL analysis.