CVE-2026-71981

Name of the Vulnerable Software and Affected Versions Cypht versions prior to 2.12.2

Description Authenticated attackers can execute arbitrary operating system commands via a PHP object injection. This occurs when a crafted PHP object graph is supplied through the back query GET parameter of the logout handler. The application decodes a base64-encoded serialized payload and passes it to the unserialize() function without an allow-list, signature check, or type restriction, allowing for gadget-chain exploitation to achieve remote code execution as the web server process.

Recommendations Update to version 2.12.2 or later. Avoid using the back query parameter in the logout handler until the update is applied.