Cypht versions prior to 2.12.2 suffer from a PHP object injection flaw that can be triggered via a crafted back_query GET parameter on the logout handler. The vulnerability allows an authenticated attacker to pass a base64‑encoded serialized PHP object graph that is decoded and directly fed to unserialize() without any allow‑list, signature check, or type restriction. This lack of validation permits gadget‑chain exploitation, resulting in remote code execution as the web server process.

The affected product is cypht-org's Cypht mail web application. All installations running Cypht versions earlier than 2.12.2 are vulnerable. Users of v2.12.2 and later are not affected as the issue has been fixed in that release.

The CVSS base score of 8.7 categorises the vulnerability as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Due to the need for authentication and an exact payload, the attack vector is likely an authenticated HTTP GET request to the logout endpoint. An attacker possessing user credentials can submit the back_query parameter to achieve arbitrary OS command execution on the web server.