Phalcon v5.20.1 / v6.0.0beta9 Released

Phalcon v5.20.1 and v6.0.0beta9 have been released. This is a security-focused maintenance release, and it also marks a change in how we would like security issues reported to us.

A word on the recent reports

Over the last few days we received an unusually large number of security reports - more than twenty in a single day - the majority of them produced with the help of AI tooling. We are genuinely grateful to everyone who took the time to look at the framework and send something in. Attention on security is always welcome, and several of the submissions pointed at areas worth tightening.

At the same time, the volume and the format created a real problem for a small team. Many of the reports overlapped, described the same underlying behavior in different words, or restated issues that were already known and, in a number of cases, already fixed in code that simply had not shipped yet. Triaging that flow - confirming what is real, what is a duplicate, and what is working as designed - takes considerable time, even with the help of AI, and doing it well matters more than doing it quickly.

For that reason we have already had a broader hardening effort underway, independent of these reports. Some of what was submitted lined up with work we had planned or completed; the rest we assessed on its own merits. This release is the first batch of that work.

Changing how security issues reach us

Going forward, we are consolidating security reporting to a single channel, our email address:

security@phalcon.io.

We are closing the other reporting avenues we had open. A private email gives us the context we need, keeps the discussion between the reporter and the team while a fix is prepared, and lets us respond without the noise of duplicate public submissions.

A few things that help us act on a report quickly:

One issue per email, with a clear title.
A concrete description of the behavior and, where possible, a minimal way to reproduce it.
The affected version and component.
Whether the value in question comes from untrusted input, and how it reaches the affected code.

We will acknowledge reports, keep reporters informed while a fix is prepared, and credit those who would like to be credited once a fix is released.

What is in this release

This release is the result of a systematic pass across the framework rather than a single fix. Without going into detail on any individual item, the work touched input filtering and sanitization, output escaping, the database and query layers, HTTP request and response handling, cryptography, sessions and authentication, storage and file handling, and the template and query compilers.

Where a change was clearly correct and safe, it shipped in this release. Where a change would alter established behavior, or where the honest answer is a documentation change rather than a code change, we have recorded it for a future major version and updated the documentation accordingly. The full list of fixed items is in the changelog below and in the release notes.

The companion v6.0.0beta9 carries the same set of changes.

Thanks

As always, thank you to everyone who reported an issue, opened a pull request, or tested a build before it shipped - and, this time, a particular thank you to everyone who sent a security report. Please keep looking; just send the next one to the address above.

Changelog

5.20.1 (2026-08-24)

Tools

Zephir 1.2.0 (32d04d5)

Changed

Added

Fixed

Attribute name and empty-option injection in the legacy Tag / Forms Select element.
Attribute name and tag name injection in the Html Tag helpers.
Attribute name splitting in the Html Escaper attributes() array keys.
Backslash breakout in the Html Escaper js() output.
Broken string-literal escaping of column defaults and ENUM/SET values in the Db dialects.
CBC padding-oracle exposure in Crypt::decrypt(), where a padding failure was distinguishable from a MAC mismatch.
Command injection via CR/LF in Beanstalk queue tube names.
CORS credentials paired with a reflected wildcard origin in the ADR Cors middleware.
Dangerous URL scheme (javascript:, data:) passthrough in the Filter url sanitizer.
Format-string denial of service in the Translate indexed-array interpolator.
Log injection via unescaped control characters in the Logger line formatter.
Missing Secure and HttpOnly flags on the Auth “remember me” cookie.
Non-constant-time credential comparison in the Auth memory and stream adapters.
Non-cryptographic randomness in the ISO-10126 padding scheme.
Object injection through unrestricted unserialize() in the Annotations Stream adapter.
Object injection through unrestricted unserialize() in the Storage Stream payload read.
Only the first configured trusted proxy checked when resolving the Request client address.
Open redirect in the ADR redirect responder bypassing the Http Response redirect() gate.
Open redirect via absolute and protocol-relative targets in the Http Response redirect().
Path traversal in the View partial() and Simple render() paths.
Path traversal via the cache key in the Storage Stream adapter.
Path traversal via the session id in the Session Stream adapter.
Reflected XSS via unescaped array keys in the Debug dump and exception renderer.
SQL injection in the Db Dialect schema-introspection methods.
SQL injection via uncast LIMIT and OFFSET values in the Db Dialect limit().
Session fixation in the Auth Session guard login.
Session id not regenerated on the Auth Session guard logout.
Unbounded image dimensions (decompression bomb / pixel flood) in the GD and Imagick image adapters.
Unbounded recursion in the WKB geometry parser.
Unescaped CSS class in Flash messages.
Unescaped identifier quoting in the DataMapper PDO connection.
Unescaped label and link in the deprecated Html Breadcrumbs.
Unescaped label text in the Html checkbox and radio helpers.
Unescaped link in the Html breadcrumbs helper.
Wrong route dispatched by the Router fast path when a static route follows a shadowing regex.

Removed

Chat - Q&A

Support

OpenCollective - Support Us

Social Media

Videos

<3 Phalcon Team