CVE-2021-23592: Deserialization of Untrusted Data in topthink/framework

The vulnerability stems from the Driver::unserialize method in the cache component. The pre-patch implementation accepted a string parameter and blindly passed it to unserialize(). While the commit diff shows a type hint removal (string -> mixed), the core issue is the lack of validation before deserialization. Attackers could manipulate cached data (an untrusted source) to include malicious payloads. The CVE description explicitly cites insecure unserialize in the Driver class, and the patch's commit message confirms the method was modified to address type-related security constraints.