The MixPHP Framework 2.x through 2.2.17 contains an unsafe deserialization vulnerability in its sync-invoke TCP server (Server.php at line 87). This server accepts data over a TCP socket bound to localhost and directly passes it to Opis\Closure\unserialize(), then executes the deserialized closure via call_user_func(). Because there is no authentication or signature verification on the TCP connection, an attacker with access to the localhost TCP port can send a malicious serialized PHP closure to achieve arbitrary code execution on the server.

Successful exploitation allows an attacker with local TCP access to execute arbitrary code on the affected system. This can lead to complete system compromise, data loss, or further attacks within the environment. The vulnerability requires local access to the TCP port bound to 127.0.0.1, limiting remote exploitation but still posing a significant risk if an attacker can reach the localhost interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the localhost TCP port used by the sync-invoke server to trusted users and processes only. Monitor for any unauthorized local access attempts. Do not expose the TCP service beyond localhost. Follow vendor updates closely for any forthcoming patches or official mitigations.