Description

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate. When NotifyUsersWorkflowAction renders the field through the Silverstripe template engine SSTemplateParser, the payload can cause PHP evaluation and arbitrary code execution on the server; the regression coverage is in tests/php/WorkflowEngineTest.php. This issue is fixed in versions 6.4.5, 7.1.3, and 7.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-27T20:17:49.817Z",
  "pubdate": "2026-08-27T20:17:49.817Z",
  "executiveSummary": "A critical Server-Side Template Injection (SSTI) vulnerability exists in the Silverstripe Advanced Workflow module, allowing authenticated users with specific permissions to achieve Remote Code Execution (RCE).\nThe vulnerability resides within the NotifyUsersWorkflowAction component, where improper handling of the EmailTemplate field enables the injection of malicious payloads into the Silverstripe template engine, SSTemplateParser.\nBy manipulating the template rendering process, an attacker can force the server to evaluate arbitrary PHP code.\nThis vulnerability affects versions prior to 6.4.5, 7.1.3, and 7.2.1.\nThe risk is high, as successful exploitation grants the attacker full control over the application's runtime environment, leading to potential data exfiltration, system compromise, or unauthorized administrative actions.\nExploitation requires the attacker to possess existing permissions to author advanced workflow email templates, representing an escalation of privileges from an authorized user to a system-level attacker.",
  "technicalDetails": "The root cause of this vulnerability is the insecure processing of user-supplied input within the NotifyUsersWorkflowAction class. Specifically, the component processes the EmailTemplate field by passing it to the SSTemplateParser engine without sufficient sanitization or sandboxing.\nThe SSTemplateParser is designed to process Silverstripe templates; however, when it encounters maliciously crafted input injected by an attacker, it fails to distinguish between legitimate template directives and executable PHP code context.\nThe attack flow begins when an attacker, already possessing authorization to configure email templates within an advanced workflow, inputs a payload designed to leverage template injection primitives. This payload is stored within the NotifyUsersWorkflowAction.EmailTemplate field.\nUpon the trigger of the workflow action, the backend invokes the rendering logic. The SSTemplateParser receives the malicious input, which, due to the lack of restrictive parsing, results in the underlying PHP engine evaluating the injected directives as dynamic code.\nThis execution context allows the attacker to execute arbitrary PHP functions, potentially leading to full server-side compromise. Because the template engine is a core component of the Silverstripe framework, this evaluation occurs within the security context of the web server process.\nThe vulnerability is identifiable within the framework's workflow engine, as noted in the regression coverage found in tests/php/WorkflowEngineTest.php. The failure to validate input against a strict whitelist or escape special characters before template compilation permits the transition from configuration modification to arbitrary code execution.\nAs this impacts the server-side rendering phase, there is no requirement for network-level access beyond the ability to interact with the administrative or workflow configuration interface of the Silverstripe CMS.\nThe post-exploitation impact is severe, granting the attacker the ability to bypass application-level authentication, read/modify database records, interact with the underlying operating system, or deploy persistent backdoors within the web application environment."
}