EUVD-2026-26674Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.
AnalysisAI
Remote code execution in MixPHP Framework 2.x through 2.2.17 allows unauthenticated network attackers to execute arbitrary code via unsafe deserialization. The FileHandler class processes session and cache data using PHP's unserialize() on filesystem-sourced content without validation, enabling object injection attacks. CVSS 9.8 critical severity with network attack vector and no privileges required. SSVC assessment confirms automatable exploitation with total technical impact. No active exploitation confirmed at time of analysis (not in CISA KEV), but publicly available proof-of-concept exists (GitHub gist reference).
Technical ContextAI
PHP's unserialize() function is a notorious attack surface because it can instantiate arbitrary objects from serialized data, triggering magic methods (__wakeup, __destruct, __toString) that execute attacker-controlled code if the application includes exploitable classes (gadget chains). MixPHP Framework 2.x implements session and cache persistence through a FileHandler class that reads serialized data from the filesystem and passes it directly to unserialize() without integrity checks or signature validation. This is a textbook CWE-502 (Deserialization of Untrusted Data) vulnerability. The affected component is identifiable in the GitHub repository at src/sync-invoke/src/Server.php in version 2.2.17. The CPE string is generic (cpe:2.3:a:n/a:n/a), indicating incomplete vendor metadata in NVD, but the GitHub references confirm the mix-php/mix repository as the authoritative source. All MixPHP Framework 2.x versions through 2.2.17 contain vulnerable FileHandler deserialization code.
RemediationAI
Upgrade to MixPHP Framework version 3.x or later if available, as the 2.x branch appears unmaintained based on the vulnerability scope (no patch version beyond 2.2.17 referenced). Consult the official MixPHP GitHub repository (https://github.com/mix-php/mix) for migration guidance or security patches. If immediate upgrade is not feasible, implement these compensating controls: (1) Replace file-based session/cache handlers with alternative backends that do not use unserialize() (Redis, Memcached with igbinary serialization, or database-backed sessions with parameterized queries). This eliminates the vulnerable code path but requires application reconfiguration and may impact session persistence across deployments. (2) Restrict filesystem permissions on session/cache directories to prevent attacker write access (chmod 700, chown to web server user only). This mitigates exploitation if attackers need to plant malicious serialized files, but does not protect against race conditions or user-uploaded content processed as cache. (3) Deploy PHP in environments without exploitable gadget chains by auditing and removing unnecessary libraries, though this is impractical for most real-world applications. (4) Implement Web Application Firewall (WAF) rules to detect PHP object injection patterns in HTTP requests, though this is easily bypassed with encoding. No vendor advisory link available; monitor https://github.com/mix-php/mix/security/advisories for official guidance.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today