CVE-2026-54718

The Silverstripe Advanced Workflow module before versions 6.4.5, 7.1.3, and 7.2.1 is vulnerable to server-side template injection (CWE-1336) in the NotifyUsersWorkflowAction.EmailTemplate field. An attacker who holds permission to author workflow email templates — a high-privilege CMS user, per the CVSS score — can store a specially crafted template payload in that field. When the workflow action renders the email through Silverstripe's SSTemplateParser template engine, the embedded payload is evaluated as PHP, giving the attacker arbitrary code execution on the web server with high impact to confidentiality, integrity, and availability. Any Silverstripe CMS installation using the affected module versions is exposed, though exploitation requires prior attacker access to a template-authoring account rather than an unauthenticated path. There is currently no known exploitation in the wild, no public proof of concept, the flaw is not in CISA KEV, and EPSS estimates only a ~0.7% chance of exploitation within 30 days.

What to do: Upgrade the advancedworkflow module to 6.4.5, 7.1.3, or 7.2.1 depending on your version branch. Until patching, restrict permission to author or edit NotifyUsersWorkflowAction email templates to fully trusted administrators, and audit existing EmailTemplate values for unexpected or crafted template directives that could be evaluated by SSTemplateParser. Prioritize environments with multiple content-author/admin accounts, since an attacker needs template-authoring privileges to plant the malicious payload.