SS-2026-002 - Template injection RCE in advanced workflow

PKSA-6bs9-m3c2-gy1z

Affected version: <6.4.6|>=7.0.0,<7.2.4

Reported by:
FriendsOfPHP/security-advisories

SS-2026-007 - RCE via template string escaping in advanced workflow email template

PKSA-mv3b-jr11-x5qf

Affected version: <6.4.6|>=7.0.0,<7.2.4

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-88990 - RCE in email template field via template execution

PKSA-ts6y-cm2s-m66j CVE-2026-88990

Affected version: <6.4.6|>=7.0.0,<7.2.4

Reported by:
FriendsOfPHP/security-advisories