What is the CVSS score of CVE-2026-37552?

CVE-2026-37552 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of MixPHP Framework are affected by CVE-2026-37552?

MixPHP Framework versions 2.0 through 2.2.17 contain an arbitrary code execution vulnerability in the sync-invoke server that allows local attackers to execute malicious PHP code via unauthenticated…

How to fix or mitigate CVE-2026-37552?

Within 24 hours: Identify all systems running MixPHP Framework 2.x versions and document their network exposure. Restrict network access to port 127.0.0.1 sync-invoke server to only trusted internal services. Within 7 days: Implement network segmentation to isolate MixPHP instances and monitor for suspicious TCP connections to affected ports. Contact MixPHP development team for patch timeline and evaluate upgrading to version 2.2.18 or later once available. Within 30 days: Deploy upgraded MixPHP Framework version and perform application security testing to verify remediation.

MixPHP Framework CVE-2026-37552

EUVD-2026-26670 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-01 mitre

PHP Deserialization RCE N A

8.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 16:30 vuln.today

EUVD ID Assigned

May 01, 2026 - 16:00 euvd

EUVD-2026-26670

Analysis Generated

May 01, 2026 - 16:00 vuln.today

CVE Published

May 01, 2026 - 00:00 nvd

HIGH 8.4

DescriptionCVE.org

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to Opis\Closure\unserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution.

AnalysisAI

Arbitrary code execution in MixPHP Framework 2.x through 2.2.17 allows local attackers to execute malicious PHP closures via unauthenticated TCP connections to the sync-invoke server. The vulnerability stems from unsafe deserialization of untrusted data on localhost-bound port 127.0.0.1, where Server.php directly passes socket data to Opis\Closure\unserialize() and executes the result without authentication or signature verification. Exploitation requires local network access or SSRF capability against the application server. No public exploit code identified at time of analysis, but the attack mechanism is straightforward for attackers with PHP deserialization knowledge.

Technical ContextAI

MixPHP Framework's sync-invoke component implements a TCP server for inter-process communication using PHP object serialization. The vulnerability exists at Server.php line 87, where the server accepts TCP connections on localhost (127.0.0.1) and deserializes incoming data using Opis\Closure\unserialize(), a library that extends PHP's native unserialization to support closures and anonymous functions. The deserialized closure is then immediately executed via call_user_func() without any validation. This represents a classic unsafe deserialization vulnerability (typically CWE-502), where untrusted data controls object instantiation and code execution. PHP deserialization attacks are well-understood and frequently leverage magic methods (__wakeup, __destruct, __toString) or in this case, direct closure execution to achieve remote code execution. The localhost binding provides some network-level protection but does not prevent exploitation by local users, compromised applications on the same host, or SSRF vectors.

RemediationAI

No vendor-released patch identified at time of analysis for MixPHP 2.2.17 or newer 2.x versions. The framework repository at https://github.com/mix-php/mix should be monitored for security advisories and patched releases addressing this deserialization flaw. Immediate compensating controls include: Disable the sync-invoke TCP server component entirely if not operationally required for inter-process communication (assess impact on application functionality first). Implement network-level access controls using firewall rules or iptables to restrict connections to the sync-invoke port only from explicitly trusted local processes or users, though this requires precise process-to-port mapping and may break legitimate IPC. Deploy application-level authentication by modifying Server.php to validate HMAC signatures or pre-shared tokens on incoming messages before deserialization (requires code changes and coordination with client components). Containerize MixPHP applications with strict network policies that prevent localhost port access from untrusted containers or host processes (note: shared network namespaces defeat this control). Monitor for migration paths to MixPHP 3.x or alternative frameworks, as the 2.x branch may be approaching end-of-life. Each mitigation has trade-offs: disabling sync-invoke may break functionality, authentication requires code maintenance, and network isolation adds operational complexity. Review the proof-of-concept at https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975 to understand the exact attack mechanism and validate effectiveness of mitigations in your environment.