{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/tastyigniter-through-4.4.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tastyigniter:tastyigniter:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-29001"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TastyIgniter (through 4.4.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["TastyIgniter"],"content_html":"\u003cp\u003eTastyIgniter through 4.4.5 contains a PHP object injection vulnerability. Authenticated administrators can submit a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by \u003ccode\u003egetValueAttribute()\u003c/code\u003e when the setting is read. This allows for the submission of a serialized gadget chain to achieve arbitrary operating-system command execution as the PHP application process user. The impact persists until the setting value is overwritten.\u003c/p\u003e\n","date_modified":"2026-10-22T03:52:08Z","date_published":"2026-10-22T03:52:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tastyigniter-php-injection/","summary":"TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary operating-system command execution.","title":"TastyIgniter: PHP object injection vulnerability (CVE-2026-29001)","url":"https://feed.craftedsignal.io/briefs/2026-10-tastyigniter-php-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - TastyIgniter (Through 4.4.5)","version":"https://jsonfeed.org/version/1.1"}