Executive brief
MixPHP is a high-performance PHP framework used for building web applications and microservices. A security flaw in its 'sync-invoke' component allows an attacker to send malicious data to the server that, when processed, executes arbitrary commands. This could lead to a complete takeover of the server, unauthorized access to sensitive data, or disruption of business operations.
Technical details
An unsafe deserialization vulnerability exists in the MixPHP Framework's sync-invoke TCP server (specifically in Server.php). The component receives data from a TCP socket and passes it directly to Opis\Closure\unserialize() without any authentication, signature verification, or class allowlisting. The resulting object is then executed via call_user_func(). An attacker can exploit this by sending a crafted serialized PHP closure to the TCP port, leading to arbitrary code execution (RCE). While some configurations bind to localhost, the vulnerability is fundamentally a pre-authentication RCE via network-accessible TCP ports.
Affected products
- MixPHP MixPHP Framework 2.x thru 2.2.17
Timeline
- 2026-04-30: disclosed: Vulnerability reported by Innora Security Research
- 2026-05-01: advisory: CVE-2026-37552 published