Executive brief
Cypht is an open-source webmail client that manages email accounts and messages. This vulnerability allows authenticated users to execute arbitrary commands on the web server by sending a specially crafted logout request. An attacker who has valid login credentials can exploit this to gain control of the server and access sensitive data or disrupt service.
Technical details
Cypht before version 2.12.2 is vulnerable to PHP object injection (CWE-502) in the logout handler. The vulnerability exists in the back_query GET parameter, which accepts a base64-encoded serialized PHP object. The application passes this parameter directly to PHP's unserialize() function without any allow-list, signature validation, or type restrictions. An authenticated attacker can craft a malicious serialized object graph that exploits PHP gadget chains to achieve remote code execution as the web server process. The fix, applied in version 2.12.2, replaces deserialization with JSON encoding, which cannot instantiate arbitrary PHP objects.
Affected products
- Cypht Cypht before 2.12.2
Timeline
- 2026-09-01: disclosed
- 2026-08-28: patched: Fix merged in commit e4aa2f34e33f9328e8c93514cc3966fc3d99925e