EUVD-2026-26674CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.
AnalysisAI
Remote code execution in MixPHP Framework 2.x through 2.2.17 allows unauthenticated network attackers to execute arbitrary code via unsafe deserialization. The FileHandler class processes session and cache data using PHP's unserialize() on filesystem-sourced content without validation, enabling object injection attacks. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running MixPHP Framework 2.x and document versions via dependency scanning and deployment inventories; isolate affected production systems from untrusted networks if upgrade is not immediately feasible. Within 7 days: Upgrade all instances to MixPHP Framework 2.2.18 or later (vendor confirmation of fixed version required); perform full application testing in staging environment before production deployment. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today