SS-2026-002 - Template injection RCE in advanced workflow

PKSA-6bs9-m3c2-gy1z

Affected version: <6.4.6|>=7.0.0,<7.2.4

Reported by:
FriendsOfPHP/security-advisories

SS-2026-007 - RCE via template string escaping in advanced workflow email template

PKSA-mv3b-jr11-x5qf

Affected version: <6.4.6|>=7.0.0,<7.2.4

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-88990 - RCE in email template field via template execution

PKSA-ts6y-cm2s-m66j CVE-2026-88990

Affected version: <6.4.6|>=7.0.0,<7.2.4

Reported by:
FriendsOfPHP/security-advisories

[HIGH] CVE-2026-54718 - Remote code execution via advanced workflow email template

PKSA-x4kf-7gbb-fh93 CVE-2026-54718 GHSA-39mm-rwm3-29jp

Affected version: <6.4.5|>=7.0.0,<7.1.3|>=7.2.0,<7.2.1

Reported by:
GitHub, FriendsOfPHP/security-advisories