Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-29001TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization

High 7.2

In plain English

A high-severity unsafe deserialization in TastyIgniter from tastyigniter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.8%top 43.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.

Affected products (as reported)

Vendor	Product	Versions
tastyigniter	TastyIgniter	0 – through 4.4.5

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, issue-tracking
VulnCheck Advisory: TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization third-party-advisory