CVE-2026-71981: Deserialization of Untrusted Data in cypht-org cypht

CVE-2026-71981 is a PHP object injection vulnerability in cypht before version 2.12.2. Authenticated attackers can supply a crafted base64-encoded serialized PHP object graph through the back_query GET parameter of the logout handler. This input is decoded and passed directly to PHP's unserialize() function without any allow-list, signature verification, or type restrictions. This lack of validation allows exploitation of gadget chains leading to remote code execution with the privileges of the web server process.

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands on the server running cypht, potentially leading to full system compromise or unauthorized access to sensitive data. The vulnerability has a high CVSS 4.0 score of 8.7, reflecting its critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the logout handler and the back_query parameter to trusted users only. Monitor for suspicious activity involving serialized data inputs. Avoid using unserialize() on untrusted data or implement strict validation and allow-listing of acceptable object types.