CVE-2026-42473

Published: May 1, 2026Modified: Jun 17, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975

Source: cve@mitre.org

https://github.com/mix-php/mix

Source: cve@mitre.org

https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php

Source: cve@mitre.org

Timeline

No history available yet.