An unsafe deserialization vulnerability exists in the MixPHP Framework 2.x through 2.2.17. The session and cache handlers invoke the PHP unserialize function on data retrieved from Redis in the RedisHandler object. This flaw can allow an attacker to supply crafted serialized payloads stored in Redis, leading to arbitrary code execution on the server where the framework runs.

The MixPHP Framework version 2.0 up to 2.2.17 is affected. No other vendors or products are identified.

Based on the description, it is inferred that the attack vector involves influencing the contents stored in Redis, such as by compromising the Redis instance or by injecting malicious payloads through the application. The scenario requires an attacker to supply crafted serialized payloads that will be deserialized by the framework. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Unsafe deserialization is a high‑severity weakness that can lead to full control of the application; it is inferred that if an attacker can inject malicious payloads into Redis, remote code execution could be achieved with no additional user interaction. The CVSS score of 9.8 emphasizes its critical nature.