CVE-2026-59989

## Summary The Volt template compiler in Phalcon generates the PHP for the `join` filter by string-concatenating the filter's **raw template-literal argument bytes** with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is emitted completely bare. A Volt template whose `join` arguments are attacker-influenced can therefore break out of the generated `join('…')` call and inject arbitrary PHP into the compiled template. Volt writes that compiled template to a cache file and `require()`s it at render time, so the injected PHP executes i.e. compile-time PHP code injection (server-side template injection -> remote code execution) for any application that compiles attacker-controlled Volt source. ## Details ### Root cause `phalcon/Mvc/View/Engine/Volt/Compiler.zep:2544-2546`: ```zephir case "join": return "join('" . funcArguments[1]["expr"]["value"] . "', " . funcArguments[0]["expr"]["value"] . ")"; ``` `funcArguments[1]["expr"]["value"]` (the separator) and `funcArguments[0]["expr"]["value"]` (the piped array) are the **raw values** of the parsed template tokens. Unlike every other expression in the compiler, they are **not** routed through `expression()` and receive no escaping: the separator value is spliced verbatim inside the `join('` … `'` quotes with no neutralisation of `'`, and the array value is emitted with no quoting at all. Volt's scanner stores string-literal bytes verbatim (escape sequences are not decoded), so attacker bytes survive intact into the generated PHP. **Generated-C ground truth** -> `build/phalcon/phalcon.zep.c` (Phalcon 5.15.0): ```c ZEPHIR_CONCAT_SVSVS(return_value, "join('", &_19$$24, "', ", &_22$$24, ")"); ``` i.e. literally `"join('" + separator + "', " + array + ")"` with both attacker-controlled fragments unescaped. The compiled output is then written to a cache file and `require`d by `Phalcon\Mvc\View\Engine\Volt::render()`, so any PH