by Kastro
Paper/Archive/CVE-2026-42472

CVE-2026-42472

mitre — Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17.

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 32.0.320 × 206.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from Redis in the RedisHandler object.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/mix-php/mixrefgithub.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.phprefgist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975