Critical · 9.8 CVE-2026-42472 EUVD-2026-26673GHSA-rr7v-4fcc-qww3

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from Red…

Published May 1, 2026 · Updated May 1, 2026 · Assigned by mitre

Description

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from Redis in the RedisHandler object.

References

https://github.com/mix-php/mix
https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php
https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975