CVE-2026-42471

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17

High · published May 1, 2026

CVSS v3.1
8.1
EPSS
2%
Percentile
79.7
In the wild
Unconfirmed
What it is

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client (Connection.php:76) calls unserialize() on data received from the server response, enabling client-side RCE if connecting to a malicious server.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01912 · 79.7th percentile
Published
2026-05-01T00:00Z
EPSS history
Timeline
  • 01 MAY 00:00Z
    Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17
    cvelistv5