CVE-2026-29001 Details

A PHP object injection vulnerability has been identified in TastyIgniter versions through 4.4.5. This vulnerability allows authenticated administrators to execute arbitrary code by submitting a serialized PHP object as a settings value. The serialized object is stored without proper sanitization and later unserialized by the getValueAttribute() method when the setting is accessed. Exploitation involves sending a crafted serialized object, such as one created with phpggc, through the admin settings form. The vulnerability allows execution of arbitrary operating system commands as the user running the PHP application, with the effects lasting until the setting value is changed.

To address this vulnerability, it is recommended to replace the native PHP serialize() and unserialize() functions with JSON-based serialization for structured settings. Additionally, settings should be treated as plain strings without deserialization, and existing serialized settings should be migrated safely to avoid instantiating arbitrary PHP objects.