Read the docs
TI-2026-50271 Aliases CVE-2026-71981GHSA-46j6-w3hw-4r9x

Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Priority MEDIUM 42CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00972 62nd percentileScored 2026-11-07
Fix Fixed cypht (cypht-org): 2.12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cypht-orgcyphtbefore 2.12.22.12.2Patch availableCNA
  • cypht Vendorcypht-org Affected before 2.12.2 Fixed in 2.12.2 Patch available CNA

Remediation

  • Fix · CNA cypht (cypht-org) Fixed in 2.12.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    cypht-org cypht 2.12.2

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-51628 Cypht < 2.12.2 XSS via FROM Email Header in Contacts ModulePriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71981
  2. 2026-10-03 Alias added: GHSA-46j6-w3hw-4r9x

References

Patch 1

Other 2

  • TI-2026-76820 Stored DOM cross-site scripting in Cypht via external image notice CVSS 4.0MEDIUM 5.3
  • TI-2026-51628 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences