CVE-2026-37552 - Vulnerability Analysis

Overview

MixPHP Framework 2.x thru 2.2.17 contains an insecure deserialization vulnerability caused by unserializing data from a TCP socket without authentication in Server.php, letting attackers with localhost TCP access execute arbitrary code.

Severity & Score

Impact

Attackers with localhost TCP access can execute arbitrary code, potentially leading to full system compromise.

Mitigation

Update to a version later than 2.2.17 or the latest available version.

References

• https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975
• https://github.com/mix-php/mix
• https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner