PHP Object Injection Vulnerability in TastyIgniter by TastyIgniter
CVE-2026-29001

8.6HIGH

Key Information:

Vendor

Tastyigniter

Status
Tastyigniter
Vendor
CVE Published:
21 October 2026

What is CVE-2026-29001?

A PHP object injection vulnerability exists in TastyIgniter versions up to 4.4.5 that allows authenticated administrators to execute arbitrary code. By submitting a serialized PHP object in the admin settings, which is stored without sanitation, attackers can exploit this flaw to run unvalidated commands under the context of the PHP application process. This vulnerability highlights the importance of validating input and securing the unserialization process to mitigate risks of unauthorized command execution within web applications.

Affected Version(s)

TastyIgniter 0 <= 4.4.5

References

https://github.com/tastyigniter/TastyIgniter/issues/1205#...
technical-description
https://www.vulncheck.com/advisories/tastyigniter-php-obj...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam MĹ‚ynarczyk
.