CVE-2026-29001

HighCVSS 7.2

Published: 21/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.79%

56th percentile - higher than 56% of all known CVEs

Summary

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form to achieve arbitrary OS command execution as the PHP application process user.

Risk Assessment

An authenticated administrator can execute arbitrary code in the application context, potentially leading to full server compromise. The impact persists until the value is overwritten.

Recommendation

Update TastyIgniter to a version later than 4.4.5 if available. Restrict administrator privileges and audit settings.

Other vulnerabilities in TastyIgniter

CVE-2026-14856Medium
A stored XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Insufficient validation of SVG files allows an authenticated low-privilege user to upload a malicious SVG with JavaScript. When an administrator views the file, the code executes in their browser context.

Original NVD description (English source)

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS