Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-71981— Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Quick assessment

Affected
cypht-org cypht
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cypht 2.12.2 之前的版本存在 PHP 对象注入漏洞，允许经过身份验证的攻击者通过构造的 PHP 对象图在退出处理程序的 back_query GET 参数中执行任意操作系统命令。攻击者可通过该参数传递 Base64 编码的序列化载荷，该载荷在被解码后会直接传入 unserialize() 函数，且未设置允许列表、签名校验或类型限制，从而可通过“小工具链”（gadget chain）利用实现以 Web 服务器进程权限执行远程代码。

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-71981

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
cypht-org cypht 0 ~ 2.12.2 -

II. Public POCs for CVE-2026-71981

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-71981

请登录查看更多情报信息。

Other References for CVE-2026-71981 (4)

IV. Related Vulnerabilities

Same product: cypht
Same vendor: cypht-org
Same weakness: CWE-502

V. Comments for CVE-2026-71981

No comments yet

Leave a comment