CVE-2026-42472 - Vulnerability Analysis

Overview

MixPHP Framework 2.x thru 2.2.17 contains an insecure deserialization caused by use of unserialize() on data from Redis in RedisHandler, letting attackers execute arbitrary code remotely, exploit requires attacker to control Redis data.

Severity & Score

Impact

Attackers can execute arbitrary code remotely by exploiting unsafe deserialization in RedisHandler.

Mitigation

Update to the latest version beyond 2.2.17 or apply patches that avoid unsafe unserialize usage.

References

• https://github.com/mix-php/mix
• https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php
• https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner