CVE-2026-71981: Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cyphtto a version that resolves this vulnerability.Fixed in 2.12.2 - Configuration
Modify the logout handler so the back_query GET parameter is not decoded and passed directly to PHP unserialize() without an allow-list/signature/type restriction; implement safe deserialization or remove unserialize() usage for this parameter.
Cypht logout handler (back_query parameter) back_query handling = Disable passing decoded back_query directly to unserialize()
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to Cypht and able to send a crafted GET request to the logout handler. Exploitation does not require user interaction and can be performed remotely over the network.
What is the impact of successful exploitation?
A successful attacker can execute arbitrary operating system commands in the context of the web server process. This can compromise the confidentiality, integrity, and availability of resources accessible to that process.
Which deployments are affected?
Cypht versions before 2.12.2 are affected. The vulnerable path processes the back_query parameter without an allow-list, signature validation, or type restriction before deserialization.
How can I determine whether exploitation may have been attempted?
Review web server and application logs for requests to the logout handler containing a back_query GET parameter, particularly unusually long base64-encoded values. Also investigate unexpected commands or processes running under the web server account.
What can be done if upgrading is not immediately possible?
Restrict access to Cypht to trusted authenticated users and, where feasible, block or strip the back_query parameter on requests to the logout handler at a reverse proxy or web application firewall. Upgrading to 2.12.2 is the available remediation indicated by the provided release reference.