CVE-2026-29001: TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenancemessage setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated as an administrator and able to submit values through the administrative settings form. The attack can be performed remotely over the network and does not require user interaction.
What level of access can successful exploitation provide?
A successful attacker can execute arbitrary operating-system commands as the user running the PHP application process. The vulnerable setting value remains effective until it is overwritten.
How can I determine whether an instance may be affected?
Instances of TastyIgniter through version 4.4.5 may be affected. Review administrative settings values for serialized PHP objects, including settings such as maintenance_message that are later read through getValueAttribute().
What can be done if patching is not immediately possible?
Restrict administrator access and review or overwrite suspicious settings values so they cannot later be unserialized. Because exploitation requires an administrator account, protecting administrative credentials and access paths reduces immediate exposure.