Remote code execution via unescaped join arguments

Code injection in Phalcon cphalcon 5.15.0 and earlier allows remote attackers to execute PHP through attacker-controlled Volt templates. Compiler.zep resolveFilter inserts raw join separator and array-token values into generated PHP instead of processing them through expression(). Exploitation requires an application to compile attacker-influenced Volt source; the code runs in the web-server process when render() requires the cached template.