The vulnerability arises from unsafe deserialization in the MixPHP Framework’s sync‑invoke TCP server. Data received from a socket is directly unserialized by Opis\Closure\unserialize() and then executed through call_user_func() with no authentication or integrity checking. Such a flaw permits an attacker to craft a serialized PHP closure that, when processed, executes arbitrary code on the host. The flaw confers full code execution privileges on the system where the server is running, representing a severe impact to confidentiality, integrity, and availability.

MixPHP Framework versions 2.x through 2.2.17 are affected. The vulnerability exists in the Server.php component of the sync‑invoke module, which binds to the localhost TCP socket 127.0.0.1. No other vendors or products are listed as impacted.

The CVSS score of 8.4 indicates high severity. The EPSS score is not available, but the flaw is listed as not in the CISA KEV catalog. An attacker with local access to the listening port can exploit the flaw; remote attackers would need to gain local access via other means. The absence of authentication means the server trusts any input from the port, making exploitation straightforward for local adversaries.