CVE-2026-42473: Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use...
CRITICAL
CVSS 9.5
Published: May 1, 2026 | Last Modified: May 1, 2026
Description
Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.
Ghostwire Analysis — What This Means Practically
- Critical CVSS score indicates maximum severity — remote code execution, authentication bypass, or complete system compromise is likely possible.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.
Security Coverage (2 articles)
References