Live › vulnerability › CVE-2026-29001
Go to dashboardTastyIgniter through 4.4.5 stores admin settings values unsanitized and unserializes them in getValueAttribute() when read. An authenticated admin can submit a phpggc gadget chain, for example via maintenance_message (loaded by CheckMaintenance.php), and run OS commands as the PHP process user. The payload persists until the setting is overwritten. CVSS 4.0 8.6, CVSS 3.1 7.2 (PR:H). No fixed version has been published yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| tastyigniter/tastyigniter | packagist | <= 4.4.5 | – |
composer show tastyigniter/tastyigniter or check composer.lock. 4.4.5 or older is affectedO:% (also check maintenance_message)v4.4.5 is the latest and is affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.
This page as .md · .json · in your agent: get_signal("CVE-2026-29001")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.