CVE-2026-29001

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting...

CVE-2026-29001 TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting...

CVE-2026-29001 TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting...

CVE-2026-29001

TastyIgniter versions up to and including 4.4.5 are vulnerable to a PHP object injection vulnerability. The root cause is the unsanitized storage and subsequent unserialization of settings values via the getValueAttribute() function. Authenticated administrators can exploit this by submitting a s...

EUVD-2026-107571

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...

CVE-2026-29001 TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting...

CVE-2026-29001

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute when the setting ...

PT-2026-120827

Name of the Vulnerable Software and Affected Versions TastyIgniter versions prior to 4.4.6 Description Authenticated administrators can achieve arbitrary code execution by submitting a serialized PHP object as a settings value. This occurs because the value is stored without sanitization and...

TastyIgniter deserialization injection vulnerability

TastyIgniter versions 4.4.5 and earlier contain a deserialization injection vulnerability. This flaw arises because setting values are not properly sanitized when stored; upon retrieval via getValueAttribute, they are deserialized, leading to PHP object injection. Attackers can submit a serialize...