Phalcon’s Volt template engine has a flaw in the resolveFilter function that builds the join filter by inserting raw separator and array token values directly into generated PHP code. When an attacker can influence the contents of a Volt template, they can inject quote‑breaking characters into the join arguments, causing arbitrary PHP to be written into the compiled cache file. When that cached template is later rendered, the injected PHP executes, yielding full remote code execution. The vulnerability represents a classic code injection scenario, identified as CWE‑94 and CWE‑1336.

The issue affects all releases of the Phalcon framework from the beginning through version 5.15.0. The vendor Phalcon (cphalcon) listed the affected products as the phalcon:cphalcon package for those releases. A fixed version is available in the 5.16.0 release.

A CVSS score of 9.2 reflects a high severity. No EPSS score is published, but the absence of a KEV listing does not lower the risk because the flaw allows arbitrary PHP execution when templates can be modified. Attackers are likely to deliver malicious content via user‑supplied data that is rendered in a Volt template or by directly modifying a template file on the server. The vulnerability is exploitable where the application processes untrusted input in Volt templates without proper sanitization.