CVE-2026-42473 - Vulnerability Analysis

Overview

MixPHP Framework 2.x thru 2.2.17 contains an insecure deserialization vulnerability caused by use of unserialize() on filesystem data in FileHandler session and cache handlers, letting attackers execute arbitrary code remotely, exploit requires crafted data in filesystem.

Severity & Score

Impact

Attackers can execute arbitrary code remotely by exploiting insecure deserialization in session and cache handlers.

Mitigation

Update to a version later than 2.2.17 or latest available version.

References

• https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975
• https://github.com/mix-php/mix
• https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner