The vulnerability is unsafe deserialization using the built‑in unserialize function on data read from the server’s filesystem. Because session and cache handlers call unserialize on files stored in the FileHandler object, an attacker who can create or modify those files could inject a serialized PHP object that triggers code execution during unserialization. This flaw can lead to arbitrary code execution on the server if the application accepts arbitrary payloads that are written to disk.

The flaw affects all releases of MixPHP Framework from version 2.0 up through 2.2.17. Applications built with any of these versions that use the default session or cache modules are vulnerable. No vendor identification is available, but the framework is maintained on GitHub and the vulnerability is known in the public code base.

The CVE has a CVSS score of 9.8, indicating a severe risk. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Despite limited exploitation data, the nature of deserialization flaws and the ability to inject malicious objects into files stored by the FileHandler mean that an attacker who can create or modify those files could trigger arbitrary code execution on the server. The risk is high for exposed web sites or services that allow writable files to the session/cache directory.