---
id: CVE-2026-71981
title: >-
  Cypht before 2.12.2 contains a PHP object injection vulnerability that allows
  authenticated attackers to execute arbitrary operating system commands by
  supplying a crafted PHP object graph in the back_query GET parameter of the
  logout ha…
summary: >-
  Cypht before 2.12.2 contains a PHP object injection vulnerability that allows
  authenticated attackers to execute arbitrary operating system commands by
  supplying a crafted PHP object graph in the back_query GET parameter of the
  logout ha…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:18:59.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71981'
references:
  - url: >-
      https://github.com/cypht-org/cypht/commit/e4aa2f34e33f9328e8c93514cc3966fc3d99925e
    label: disclosure@vulncheck.com
  - url: 'https://github.com/cypht-org/cypht/pull/2073'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/cypht-org/cypht/releases/tag/v2.12.2'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/cypht-php-object-injection-rce-via-back-query-parameter
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
epss: 0.00565
epssPercentile: 0.45459
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/lyn4r/CVE-2026-71981'
  checkedAt: '2026-09-21T15:30:24.159Z'
exploitAvailable: true
ingestedAt: '2026-09-08T21:11:12.289Z'
---

## Overview

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.