Key points
- TastyIgniter versions through 4.4.5 contain a high-severity PHP object injection flaw.
- Authenticated administrators can trigger arbitrary code execution via unsanitized settings.
- No patch has been confirmed; exposure persists until values are overwritten or updated.
TastyIgniter installations running version 4.4.5 or earlier are affected by a vulnerability that allows remote code execution. The flaw exists in how the application handles saved settings. An attacker who has administrative access can exploit this weakness to run commands on the server.
In plain English
The vulnerability is a PHP object injection issue. When an admin saves a setting, the system stores the data without proper sanitization. Later, when the setting is read, the system processes the stored data in a way that allows malicious code to run. Attackers can submit specially crafted data, known as a gadget chain, through the admin settings form. This allows them to execute operating-system commands as the PHP application user.
The background
The issue is tracked as CVE-2026-29001. The National Vulnerability Database rates the severity as 8.6, which is classified as high. The weakness falls under CWE-502, which covers deserialization of untrusted data. The specific function involved is getValueAttribute(), which unserializes the stored setting values. Attackers can target settings like the maintenance_message, which is loaded by CheckMaintenance.php.
What changes now
No official fix or update has been confirmed for this vulnerability yet. The risk remains active for all installations using TastyIgniter version 4.4.5 or older. Administrators must rely on mitigation strategies or wait for vendor guidance. The impact of a successful attack persists until the affected setting value is overwritten. Users should monitor for official announcements regarding patches.
Who needs to act first
Teams usually prioritize systems exposed to the internet or connected to sensitive data. Check whether your TastyIgniter instances are accessible to potential attackers. Reduce exposure by restricting administrative access to trusted networks. Test any mitigation steps in a non-production environment first. Back up your configuration files before making changes. Ensure logging is enabled to detect unauthorized access attempts.
What to do and how to stay safe: TastyIgniter
- Restrict access to the TastyIgniter admin panel using IP whitelisting or multi-factor authentication.
- Monitor server logs for unusual command execution or unexpected changes to setting values.
- Verify that the PHP application process runs with minimal privileges to limit potential damage.
- Wait for the vendor to provide an update before attempting unverified workarounds.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which TastyIgniter versions are affected?
TastyIgniter versions up to and including 4.4.5 are affected by this vulnerability.
What is the severity of CVE-2026-29001?
The National Vulnerability Database rates the severity as 8.6, which is classified as high.
Is there a patch available?
No patch or fix has been confirmed yet for this vulnerability.
