The MixPHP Framework contains an unsafe deserialization flaw in its sync-invoke client. The client calls PHP's unserialize() on data received from a server without validating or filtering the payload. An attacker who controls the server can send a crafted serialized object that, when deserialized on the client, triggers arbitrary code execution on the client machine. This can be achieved purely through normal client usage, as the vulnerability does not require any local privileges.

Affected versions are all releases of MixPHP Framework 2.x that include the sync-invoke feature, up to and including version 2.2.17. No later versions are known to contain the flaw, and the vulnerability is not limited to a specific submodule; any component that invokes sync-invoke is impacted.

The CVSS score of 8.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a client initiating a request to a malicious server that returns a malicious payload. The flaw enables client-side code execution with the privileges of the client process, potentially allowing further compromise of the host if the client runs with elevated rights. No exploitation probability metrics are provided, but the high CVSS and lack of mitigation from the vendor imply a serious risk.