---
id: "CVE-2026-29001"
kind: "vulnerability"
aliases: ["CVE-2026-29001"]
title: "TastyIgniter: admin settings input runs code via PHP object injection"
severity: "high"
cvss: 8.6
epss: 0.00644
exploited: false
status: "open"
category: "package"
products: [{"name": "tastyigniter/tastyigniter", "fixed": [], "affected": "<= 4.4.5", "ecosystem": "packagist"}]
ecosystems: ["packagist"]
tags: ["package", "php", "self-hosted", "tastyigniter"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-21T21:17:59+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29001", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:46:18+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-29001", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# TastyIgniter: admin settings input runs code via PHP object injection

TastyIgniter through 4.4.5 stores admin settings values unsanitized and unserializes them in getValueAttribute() when read. An authenticated admin can submit a phpggc gadget chain, for example via maintenance_message (loaded by CheckMaintenance.php), and run OS commands as the PHP process user. The payload persists until the setting is overwritten. CVSS 4.0 8.6, CVSS 3.1 7.2 (PR:H). No fixed version has been published yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- packagist:tastyigniter/tastyigniter affected <= 4.4.5 fixed ?

## How to check

Run 'composer show tastyigniter/tastyigniter' or check composer.lock. 4.4.5 or older is affected. Look for serialized PHP objects in stored settings: in the settings table, SELECT item, value WHERE value LIKE 'O:%' (also check maintenance_message). Review admin accounts and the admin audit trail for unexpected settings changes.

## Fix

No patched release known as of 2026-10-23; v4.4.5 is the latest and is affected. Until a fix ships: restrict admin access (strong passwords, MFA, IP allowlist), remove unknown admin users, clear any serialized-object values in settings, and watch https://github.com/tastyigniter/TastyIgniter/releases.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-29001
- 2026-10-23T23:46:18+00:00 analyst — VulnCheck (CNA) and GHSA-736x-jrr3-jq2x confirm TastyIgniter <= 4.4.5, credit Adam Młynarczyk. No fixed release found: latest GitHub release is v4.4.5 (12 Oct), which is itself affected. No public PoC or exploitation evidence found, and no social discussion searched. NVD page returned not found.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-29001

## Documents

- [advisory] VulnCheck: TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization https://www.vulncheck.com/advisories/tastyigniter-php-object-injection-via-settings-deserialization
- [advisory] GHSA-736x-jrr3-jq2x (CVE-2026-29001) https://github.com/advisories/GHSA-736x-jrr3-jq2x
- [mentions] TastyIgniter releases (latest v4.4.5) https://github.com/tastyigniter/TastyIgniter/releases

## From the sources

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_