CVE-2026-37552: MixPHP Framework Unsafe Deserialization Exposes Servers to RCE

The National Vulnerability Database has detailed CVE-2026-37552, a high-severity unsafe deserialization vulnerability impacting MixPHP Framework versions 2.x through 2.2.17. This flaw resides in the sync-invoke TCP server (Server.php:87), which directly passes data from a localhost TCP socket to Opis\Closure\unserialize() and then executes the result via call_user_func(). There is no authentication or signature verification, allowing a local attacker to achieve arbitrary code execution.

This isn’t a remote RCE in the typical sense; the server binds to 127.0.0.1. However, local privilege escalation or chaining with another vulnerability that grants localhost access is a clear path to exploitation. The ability to execute arbitrary PHP closures means full system compromise is on the table once an attacker has that initial foothold. A CVSS score of 8.4 (HIGH) reflects this critical impact, with high confidentiality, integrity, and availability impacts.

Defenders need to understand the chaining potential here. While not directly internet-facing, any compromise of a web server or application running MixPHP Framework could quickly lead to full host takeover via this vulnerability. It’s a critical component in a multi-stage attack and should not be dismissed due to its local access requirement.