CVE-2026-71981

Cypht before 2.12.2 contains a PHP object injection (insecure deserialization, CWE-502) flaw in its logout handler that lets an authenticated user execute arbitrary operating system commands on the server. The handler accepts a base64-encoded serialized PHP object passed in the 'back_query' GET parameter and feeds it directly to unserialize() with no allow-list, signature check, or type restriction, so a crafted object graph can be unserialized into a gadget chain. Successful gadget-chain exploitation yields remote code execution as the web server process, with high impact on confidentiality, integrity, and availability (CVSS 4.0: 8.7). Any organization or individual running an unpatched Cypht instance is affected whenever the attacker can authenticate with valid webmail credentials. Exploitation has not been reported in the wild and the flaw is not in the CISA KEV catalog, but a public proof-of-concept (github.com/lyn4r/CVE-2026-71981) exists and EPSS currently rates near-term exploitation risk at about 0.6%.

What to do: Upgrade Cypht to 2.12.2 or later, which resolves this insecure deserialization in the logout handler. Until patched, review web server access logs for base64-encoded serialized payloads in the 'back_query' parameter of logout requests and consider a WAF/reverse-proxy rule to restrict that parameter, since a public PoC exists. Because exploitation requires valid webmail credentials, also verify no low-privileged accounts have been compromised on exposed instances.