TastyIgniter: PHP object injection vulnerability (CVE-2026-29001)
TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary operating-system command execution.
CVE search metadata
CVE search record: CVE-2026-29001. Severity: high. CVSS: 7.2. KEV: no. Product: TastyIgniter (through 4.4.5). Brief: TastyIgniter: PHP object injection vulnerability (CVE-2026-29001). Brief link: https://feed.craftedsignal.io/briefs/2026-10-tastyigniter-php-injection/
Triage facts
Revision 1- Applicability
- TastyIgniter (through 4.4.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 22, 03:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
TastyIgniter through 4.4.5 contains a PHP object injection vulnerability. Authenticated administrators can submit a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. This allows for the submission of a serialized gadget chain to achieve arbitrary operating-system command execution as the PHP application process user. The impact persists until the setting value is overwritten.