CVE-2026-37552
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
An unsafe deserialization vulnerability exists in MixPHP Framework versions 2.x through 2.2.17. The sync-invoke TCP server receives data from a TCP socket and passes it directly to Opis\Closure\unserialize(), then executes the result via call_user_func(). No authentication or signature verification is performed on the TCP connection, allowing an attacker with access to the localhost TCP port (server binds 127.0.0.1) to send a crafted serialized PHP closure to achieve arbitrary code execution.
Risk Assessment
An attacker with access to the local TCP port can execute arbitrary code on the server, leading to full compromise of the application and potentially the entire system.
Recommendation
Immediately update MixPHP Framework to the latest available version that fixes this vulnerability. If an update is not possible, restrict access to the TCP port to trusted hosts only or disable the sync-invoke server.
Other vulnerabilities in MixPHP Framework
Original NVD description (English source)
Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to Opis\Closure\unserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution.