{"affected":[{"defaultStatus":"affected","ecosystem":"github","packageName":"cypht-org/cypht","product":"cypht","source":"CNA: VulnCheck","vendor":"cypht-org","versions":[{"lessThan":"2.12.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-71981","cwes":["CWE-502"],"description":"Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.","epss":{"date":"2026-11-08","percentile":0.62209,"score":0.00972},"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.8,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794146918086,"publishedAt":1788295388844,"references":[{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/cypht-org/cypht/releases/tag/v2.12.2"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/cypht-org/cypht/pull/2073"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/cypht-org/cypht/commit/e4aa2f34e33f9328e8c93514cc3966fc3d99925e"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/cypht-php-object-injection-rce-via-back-query-parameter"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/cypht-org/cypht/pull/2073"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/cypht-org/cypht/commit/e4aa2f34e33f9328e8c93514cc3966fc3d99925e"}],"revision":"80fd91d5f7ade30d1bcda170132d38b082c25889e593321751c652eec2641657","sources":[{"modifiedAt":1794146918086,"name":"CNA: VulnCheck","retrievedAt":1794151331537,"url":"https://www.cve.org/CVERecord?id=CVE-2026-71981"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794151337493,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71981"}],"ssvc":{"assessedAt":1788360761224,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter","updatedAt":1794151337493}