{"action":"Upgrade symbiote/silverstripe-advancedworkflow to 6.4.5 or later.","affected":[{"fixed":"6.4.5","introduced":"0"},{"fixed":"7.1.3","introduced":"7.0.0"},{"fixed":"7.2.1","introduced":"7.2.0"}],"component":"symbiote/silverstripe-advancedworkflow","cve_ids":["CVE-2026-54718"],"ecosystem":"Packagist","epss":0.01047,"exploited":false,"fixed_versions":["6.4.5","7.1.3","7.2.1"],"ghsa_id":"GHSA-39mm-rwm3-29jp","id":"tcs_01M5KESVHVAD871NQ7HSN3KPB7","modified_at":"2026-09-11T05:15:04.550979119Z","published_at":"2026-08-27T17:20:40Z","references":["https://osv.dev/vulnerability/GHSA-39mm-rwm3-29jp","https://github.com/silverstripe/silverstripe-advancedworkflow/security/advisories/GHSA-39mm-rwm3-29jp","https://github.com/silverstripe/silverstripe-advancedworkflow/pull/629","https://github.com/silverstripe/silverstripe-advancedworkflow/pull/630","https://github.com/silverstripe/silverstripe-advancedworkflow/commit/28d0b536491e5c68b1c445579bdd1ddc8beaf8bb","https://github.com/silverstripe/silverstripe-advancedworkflow/commit/f170766af992ed2ed3e5f21d127d0d0d3129678b","https://github.com/FriendsOfPHP/security-advisories/blob/master/symbiote/silverstripe-advancedworkflow/CVE-2026-54718.yaml","https://github.com/silverstripe/silverstripe-advancedworkflow","https://github.com/silverstripe/silverstripe-advancedworkflow/releases/tag/6.4.5","https://github.com/silverstripe/silverstripe-advancedworkflow/releases/tag/7.1.3","https://github.com/silverstripe/silverstripe-advancedworkflow/releases/tag/7.2.1","https://www.silverstripe.org/download/security-releases/cve-2026-54718"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-39mm-rwm3-29jp","url":"https://osv.dev/vulnerability/GHSA-39mm-rwm3-29jp"}],"summary":"silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template"}