Vulnerability · Published Sep 1, 2026 · Assigned by VulnCheck

CVE-2026-71981Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

High 8.8

In plain English

A high-severity unsafe deserialization in cypht from cypht-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.0%top 37.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.

Affected products (as reported)

Vendor	Product	Versions
cypht-org	cypht	0 – before 2.12.2

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/cypht-php-object-injection-rce-via-back-query-parameter third-party-advisory