Phalcon vulnerabilities
We track 3 vulnerabilities in Phalcon products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 21, 2026.
Latest Phalcon vulnerabilities
- 9.2 Critical severity
cphalcon: Improper Control of Generation of Code
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them thro
- 8.7 High severity
cphalcon: Inefficient Regular Expression Complexity
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced b
- 8.2 High severity
cphalcon: Observable Timing Discrepancy
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison t