by Kastro
Paper/Archive/CVE-2026-42473

CVE-2026-42473

mitre — Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17.

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 32.0.320 × 206.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/mix-php/mixrefgithub.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.phprefgist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975