CVE-2026-42472 Details

A vulnerability allowing remote code execution through unsafe deserialization has been identified in MixPHP Framework versions 2.x prior to 2.2.17. The issue arises in the RedisHandler object, where session and cache handlers use the unserialize() function on data from Redis, without any validation or integrity checks. This vulnerability can be exploited by compromising the data store and injecting malicious payloads that are executed on the application server.

To address this vulnerability, it is recommended to use an allowlist with the unserialize() function to prevent the deserialization of untrusted data. Alternatively, replace unserialize() with JSON serialization when object types are not necessary.