Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to Opis\Closure\unserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution.
References
| Link | Resource |
|---|---|
| https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975 | Third Party Advisory |
| https://github.com/mix-php/mix | Product |
| https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php | Product |
Configurations
History
08 Jul 2026, 03:26
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Openmix mix Php
Openmix |
|
| CPE | cpe:2.3:a:openmix:mix_php:*:*:*:*:*:*:*:* | |
| References | () https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975 - Third Party Advisory | |
| References | () https://github.com/mix-php/mix - Product | |
| References | () https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php - Product |
01 May 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-502 |
01 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-01 16:16
Updated : 2026-07-08 03:26
NVD link : CVE-2026-37552
Mitre link : CVE-2026-37552
CVE.ORG link : CVE-2026-37552
JSON object : View
Products Affected
openmix
- mix_php
CWE
CWE-502
Deserialization of Untrusted Data