PHP Object Injection in Cypht

Cypht versions prior to 2.12.2 are vulnerable to a PHP object injection flaw. The vulnerability resides in the application's logout handler, specifically within the processing of the 'back_query' GET parameter. An authenticated attacker can supply a malicious, base64-encoded serialized PHP object graph. The application decodes and passes this input directly to the PHP unserialize() function without implementing an allow-list, signature verification, or proper type restrictions. This lack of validation allows attackers to trigger gadget-chain exploitation, resulting in remote code execution (RCE) with the privileges of the web server process. Defenders should prioritize patching affected Cypht instances to version 2.12.2 or later to mitigate this risk.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary system commands on the underlying host, leading to full compromise of the web server, potential lateral movement within the network, and exfiltration of sensitive application data.

Recommendation

1. Upgrade all Cypht instances to version 2.12.2 or later immediately to patch CVE-2026-71981.
2. Monitor web server access logs for anomalous requests to the logout handler containing base64-encoded strings within the 'back_query' parameter.
3. Implement strict request validation for all parameters passed to deserialization functions within the environment.