PT-2026-36488 · Unknown · Mixphp Framework

Sginnora · Published 2026-05-01 · Updated 2026-05-05 · CVE-2026-42471

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MixPHP Framework versions 2.x through 2.2.17

Description An unsafe deserialization issue exists in the sync-invoke client within the Connection.php file at line 76. The client uses the unserialize() function on data received from server responses, which can lead to client-side remote code execution (RCE) if the client connects to a malicious server. Unsafe deserialization occurs when untrusted data is used to instill an object, allowing an attacker to manipulate the object's state to execute arbitrary code.

Recommendations Update MixPHP Framework to a version later than 2.2.17.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-42471

Affected Products

Mixphp Framework

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-42471 · Security Note
• https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php · Note
• https://github.com/mix-php/mix · Note
• https://t.me/cveNotify/162248 · Telegram Post
• https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975 · Note
• https://twitter.com/CVEnew/status/2050254042140438878 · Twitter Post
• https://twitter.com/infoflowcloud/status/2050255585854058940 · Twitter Post