CVE-2026-71981

HighCVSS 8.8

Published: 01/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

45th percentile - higher than 45% of all known CVEs

Summary

Cypht before 2.12.2 contains a PHP object injection vulnerability allowing authenticated attackers to execute arbitrary OS commands via a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload, decoded and passed directly to unserialize() without allow-list, signature check, or type restriction, enabling gadget-chain exploitation for RCE as the web server process.

Risk Assessment

An authenticated attacker can execute arbitrary commands on the server, leading to full application compromise and potentially the entire system.

Recommendation

Upgrade Cypht to 2.12.2 or later and restrict application access to trusted users only.

Other vulnerabilities in Cypht

CVE-2026-73524Medium
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.

Original NVD description (English source)

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS