EUVD-2026-26673CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from Redis in the RedisHandler object.
AnalysisAI
Remote unauthenticated code execution in MixPHP Framework 2.x through 2.2.17 allows attackers to execute arbitrary PHP code by injecting malicious serialized objects into Redis-backed session or cache storage. The framework's RedisHandler directly deserializes untrusted data from Redis using PHP's unserialize() function without validation. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running MixPHP Framework 2.x and document current versions; implement network-level restrictions to Redis ports and verify only trusted clients can connect. Within 7 days: Evaluate upgrading to MixPHP Framework 2.2.18 or later if available, or apply the RedisHandler deserialization fix from vendor; contact MixPHP maintainers for patch timeline confirmation. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today