CVE-2026-42473
Published: 01 May 2026
Summary
CVE-2026-42473 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-42473 is an unsafe deserialization vulnerability in the MixPHP Framework versions 2.x through 2.2.17. The issue stems from the session and cache handlers using the unserialize() function on data read from the filesystem within the FileHandler object, as classified under CWE-502. Published on 2026-05-01, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts across confidentiality, integrity, and availability.
The vulnerability can be exploited by any unauthenticated attacker with network access to the affected application, requiring low complexity and no user interaction. Exploitation involves triggering the deserialization of malicious data from filesystem-stored sessions or cache, which could lead to arbitrary code execution or other severe consequences aligned with the high CVSS impact metrics.
Advisories and related resources, including a GitHub Gist at https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975, the MixPHP repository at https://github.com/mix-php/mix, and the vulnerable Server.php file at https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php, provide further details on the issue and potential mitigations such as upgrading to a patched version or avoiding filesystem-based handlers.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26674
Vulnerability details
Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an unauthenticated remote code execution vulnerability via unsafe deserialization in a public-facing PHP web framework, directly enabling exploitation of public-facing applications over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unsafe deserialization flaw in MixPHP Framework by identifying, prioritizing, and applying patches or upgrades to eliminate the vulnerability.
Enforces secure configuration settings to avoid or disable vulnerable filesystem-based session and cache handlers in the FileHandler object.
Validates session and cache data loaded from the filesystem prior to deserialization to block malicious payloads, though limited against complex gadget chains.