CVE-2026-71981

Received Received - Intake

PHP Object Injection in Cypht Leading to RCE

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-71981

Affected Vendors & Products

Vendor	Product	Version / Range
cypht	cypht	to 2.12.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

Cypht before 2.12.2 has a PHP object injection flaw in the logout handler. Authenticated attackers can exploit this by sending a crafted PHP object graph via the back_query GET parameter. The payload is base64-decoded and passed to unserialize() without validation, allowing gadget-chain attacks to execute arbitrary OS commands as the web server process.

Detection Guidance

To detect this vulnerability, monitor for unusual activity in the logout handler of Cypht, particularly requests to the back_query parameter with base64-encoded payloads. Check server logs for unserialize() calls or unexpected command execution attempts. Use network traffic analysis to identify suspicious GET requests targeting the logout endpoint.

Impact Analysis

If you use Cypht versions before 2.12.2, attackers with valid credentials could take over your server, steal data, or install malware. The flaw enables full remote code execution, meaning attackers can run any command on your system with the same privileges as the web server.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR (data protection) and HIPAA (health data privacy). Unauthorized command execution may expose sensitive user data, triggering compliance violations, fines, or legal consequences due to inadequate security controls.

Mitigation Strategies

Immediately upgrade Cypht to version 2.12.2 or later. If upgrading is not possible, disable the logout handler's back_query parameter or implement strict input validation to block base64-encoded serialized payloads. Restrict access to authenticated users only and monitor for unauthorized command execution attempts.

Hi! I’m here to help you understand CVE-2026-71981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70