PatchTheCVECVE-2026-29001: TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrato
CVE-2026-29001 is a high-severity flaw (CVSS 7.2) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.2 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 50%) |
| CISA exploited list | No |
| Weakness | CWE-502 |
| Published | 2026-10-21 |
| Last modified | 2026-10-22 |
Last updated 2026-10-22 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-29001?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-29001 being exploited?
CVE-2026-29001 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-29001 affect?
CVE-2026-29001 affects affected software. Severity is high (CVSS 7.2). TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and
How urgent is CVE-2026-29001?
Priority 38/100. High severity