CVE-2026-29001

Name of the Vulnerable Software and Affected Versions TastyIgniter versions prior to 4.4.6

Description Authenticated administrators can achieve arbitrary code execution by submitting a serialized PHP object as a settings value. This occurs because the value is stored without sanitization and subsequently processed by the getValueAttribute() function. An attacker can use the admin settings form, such as the maintenance message setting loaded by CheckMaintenance.php, to submit a serialized gadget chain. This allows the execution of arbitrary operating-system commands as the PHP application process user, and the effect remains until the value is overwritten.

Recommendations Update TastyIgniter to version 4.4.6 or later. As a temporary mitigation, restrict access to the admin settings form and avoid modifying settings values until the update is applied.