A remote code execution vulnerability has been identified in MixPHP Framework versions 2.x through 2.2.17. The flaw, tracked as CVE-2026-42471, stems from the application passing user-controlled input directly into PHP’s unserialize() function without proper validation.
The vulnerability is straightforward in its mechanics. When an attacker can supply serialized data that gets processed by unserialize(), they can craft a gadget chain using PHP’s magic methods — specifically __destruct() — to execute arbitrary system commands. The proof of concept demonstrates a simple class with a __destruct() method that calls system() with attacker-controlled input.
This type of vulnerability is well-known in the PHP security community, but it continues to surface in frameworks that don’t adequately sanitize or avoid unserialize() calls on user input. Applications using MixPHP 2.x should immediately check whether they pass any user-controlled data to unserialize() and upgrade to a patched version as soon as one becomes available.
The vulnerability was tested on Ubuntu 26.04 LTS with PHP 8.3.6. Any environment running MixPHP 2.x through 2.2.17 with endpoints that accept serialized data should be considered at risk.
