{"id":"CVE-2026-29001","kind":"vulnerability","aliases":["CVE-2026-29001"],"related":[],"title":"TastyIgniter: admin settings input runs code via PHP object injection","description":"TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.","summary":"TastyIgniter through 4.4.5 stores admin settings values unsanitized and unserializes them in getValueAttribute() when read. An authenticated admin can submit a phpggc gadget chain, for example via maintenance_message (loaded by CheckMaintenance.php), and run OS commands as the PHP process user. The payload persists until the setting is overwritten. CVSS 4.0 8.6, CVSS 3.1 7.2 (PR:H). No fixed version has been published yet.","severity":"high","cvss":8.6,"epss":0.00644,"exploited":false,"exploited_at":null,"products":[{"name":"tastyigniter/tastyigniter","fixed":[],"affected":"<= 4.4.5","ecosystem":"packagist"}],"ecosystems":["packagist"],"tags":["package","php","self-hosted","tastyigniter"],"not_affected_if":["auth-required","default-config"],"how_to_check":"Run 'composer show tastyigniter/tastyigniter' or check composer.lock. 4.4.5 or older is affected. Look for serialized PHP objects in stored settings: in the settings table, SELECT item, value WHERE value LIKE 'O:%' (also check maintenance_message). Review admin accounts and the admin audit trail for unexpected settings changes.","fix":"No patched release known as of 2026-10-23; v4.4.5 is the latest and is affected. Until a fix ships: restrict admin access (strong passwords, MFA, IP allowlist), remove unknown admin users, clear any serialized-object values in settings, and watch https://github.com/tastyigniter/TastyIgniter/releases.","status":"open","published_at":"2026-10-21T21:17:59+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:39:20+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:39:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TastyIgniter: admin settings input runs code via PHP object injection","impact":"high","summary":"TastyIgniter through 4.4.5 stores admin settings values unsanitized and unserializes them when read, so a PHP object gadget chain runs commands as the web app user. An attacker needs an admin account, and the payload stays active until the setting is overwritten.","category":"package","who_cares":["tastyigniter","php","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs operating-system commands as the PHP application user.","analyst_note":"Find the fixed TastyIgniter release and its changelog or the NVD/GitHub advisory to confirm the patched version and a safe check.","how_to_check":"Check your TastyIgniter version in composer.lock or the admin dashboard; anything 4.4.5 or older is in scope.\nReview stored settings values for serialized PHP objects (strings starting with O: or a:), e.g. in the settings table for maintenance_message.\nunknown","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000519,"input_tokens":3017,"output_tokens":435,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed TastyIgniter release and its changelog or the NVD/GitHub advisory to confirm the patched version and a safe check.","search":"'-2026':12A,15A '-29001':13A,16A '3.1':77B '4.0':74B '4.4.5':26B,90C '7.2':78B '8.6':75B 'achiev':102C,158C 'admin':2A,28B,41B,145C 'administr':100C 'allow':98C 'applic':168C 'arbitrari':103C,159C 'attack':130C 'authent':40B,99C 'chain':47B,136C 'checkmaintenance.php':55B,156C 'code':6A,104C 'command':59B,163C 'contain':91C 'cve':11A,14A 'cvss':73B,76B 'exampl':49B,149C 'execut':105C,164C 'fix':82B 'form':147C 'gadget':46B,135C 'generat':140C 'getvalueattribut':36B,124C 'h':80B 'host':22B 'impact':173C 'inject':10A,95C 'input':4A 'later':121C 'load':53B,154C 'mainten':51B,151C 'messag':52B,152C 'object':9A,94C,111C 'one':139C 'oper':161C 'operating-system':160C 'os':58B 'overwritten':72B,179C 'packag':18B 'payload':66B 'persist':67B,174C 'php':8A,19B,62B,93C,110C,167C 'phpggc':45B,142C 'pr':79B 'process':63B,169C 'publish':86B 'read':38B,129C 'run':5A,57B 'self':21B 'self-host':20B 'serial':109C,134C 'set':3A,29B,70B,114C,127C,146C,153C 'store':27B,118C 'submit':43B,107C,132C 'system':162C 'tastyignit':1A,23B,24B,88C 'tastyigniter/tastyigniter':17A 'unsanit':31B,119C 'unseri':33B,122C 'user':64B,170C 'valu':30B,115C,177C 'version':83B 'via':7A,50B,141C 'vulner':96C 'yet':87B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T21:17:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-29001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29001","severity":null,"published_at":"2026-10-21T21:17:59+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-29001:516","url":null,"severity":null,"published_at":"2026-10-23T23:46:18+00:00","modified_at":"2026-10-23T23:46:18+00:00","first_seen_at":"2026-10-23T23:46:18+00:00","fetched_at":"2026-10-23T23:46:18+00:00","note":"VulnCheck (CNA) and GHSA-736x-jrr3-jq2x confirm TastyIgniter <= 4.4.5, credit Adam Młynarczyk. No fixed release found: latest GitHub release is v4.4.5 (12 Oct), which is itself affected. No public PoC or exploitation evidence found, and no social discussion searched. NVD page returned not found."},{"source":"epss","external_id":"CVE-2026-29001","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-29001","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":2155,"url":"https://www.vulncheck.com/advisories/tastyigniter-php-object-injection-via-settings-deserialization","title":"VulnCheck: TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2156,"url":"https://github.com/advisories/GHSA-736x-jrr3-jq2x","title":"GHSA-736x-jrr3-jq2x (CVE-2026-29001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2157,"url":"https://github.com/tastyigniter/TastyIgniter/releases","title":"TastyIgniter releases (latest v4.4.5)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}