Silverstripe Advanced Workflow allowed an attacker with permission to edit workflow email templates to inject a specially crafted server‑side template payload. When the NotifyUsersWorkflowAction.EmailTemplate field is rendered by the Silverstripe template engine SSTemplateParser, the payload is evaluated as PHP code, giving the attacker arbitrary server‑side code execution. This flaw is a classic example of server‑side template injection, classified as CWE‑1336, and would let a malicious actor compromise the confidentiality, integrity, and availability of the hosting environment.

The vulnerability affects Silverstripe Advanced Workflow versions older than 6.4.5, 7.1.3, or 7.2.1. Users of any of these earlier releases should verify their installed version and upgrade to the fixed releases released by Silverstripe.

The flaw carries a CVSS score of 7.2, indicating a high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. While no public exploit is known, the ability for authenticated users to edit email templates means the attack vector is limited to individuals with workflow design privileges. Given the potential for arbitrary code execution on the server, the risk is considerable, especially in environments where workflow authoring is not tightly controlled.