VULNERABILITY INTELLIGENCE

CVE-2026-71981

CVSS score8.8 HIGH

EPSS probability0.44%

CISA KEVNot currently listed

Published2026-09-01

Last modified2026-09-08

Description

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload t…