HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-29001 — TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that all...

·Source: NIST NVD

Updated:

Executive Summary

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through th

Analysis

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten. CVSS Score: 7.2. Published: 2026-10-21T21:17:59.230.

Indicators of Compromise (1)

CVE (1)
CVE-2026-29001
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 21, 2026. Verified by: NIST.

Related Threats

CRITICALZero DayExploited

UNC3886 Deploys Firmware Rootkit on Juniper MX Routers via Zero-Day

UNC3886 exploits Juniper Junos zero-day to deploy firmware-level rootkits on MX-series routers. Implant survives software upgrades and factory resets.

CVE-2026-29001Juniper MX Series
Mandiant
MEDIUMVulnerabilityNEW

Student SSNs and Medicaid IDs Exposed in Frontline School Software Breach

Kalleigh Lane reports: If your school district used Frontline Central or School Health Management, your Social Security number, date of birth, or government ID could have been caught up in a cybersecurity incident. That risk applies to some adults and minors whose information was processed through those products. Frontline Education announced Oct. 26, 2026, that...

DataBreaches.net
MEDIUMVulnerabilityNEW

GM settles with 36 states for selling driver data, agrees to $220 million fine and reforms

General Motors agreed to pay $220 million to settle a lawsuit filed by a coalition of 36 state attorneys general who alleged the company unlawfully sold information about driver behavior to outside parties.

The Record