Critical · 9.8 CVE-2026-42473 EUVD-2026-26674GHSA-32hx-8wcv-5q49

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the…

Published May 1, 2026 · Updated May 1, 2026 · Assigned by mitre

Description

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.

References

https://github.com/mix-php/mix
https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php
https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975