Read the docs
TI-2026-79001 Aliases CVE-2026-29001GHSA-736x-jrr3-jq2x

PHP object injection in TastyIgniter enables command execution

Priority MEDIUM 41CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

TastyIgniter through 4.4.5 contains a PHP object injection flaw (CWE-502) in which settings values are stored without sanitization and later unserialized when read. An authenticated administrator who submits a serialized PHP object through the admin settings form can execute arbitrary operating system commands as the PHP application process user. The impact persists until the value is overwritten.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00786 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tastyigniterTastyIgniterup to 4.4.5—No fix listedCNA
  • TastyIgniter Vendortastyigniter Affected up to 4.4.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for TastyIgniter.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-29001
  2. 2026-10-21 Alias added: GHSA-736x-jrr3-jq2x
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-28 CISA SSVC decision points changed
  5. 2026-10-28 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2025-37990 Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the… CVSS 3.1HIGH 8.8
  • TI-2024-29865 TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice()… CVSS 3.1HIGH 8.1
  • TI-2021-16270 TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs. CVSS 3.1MEDIUM 5.4
  • TI-2024-29866 TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders… CVSS 3.1MEDIUM 6.5
  • TI-2022-07469 A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of… CVSS 3.1MEDIUM 5.4
  • TI-2022-00519 Cross-site Scripting (XSS) - DOM in tastyigniter/tastyigniter CVSS 3.1MEDIUM 5.4
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences