TastyIgniter up to 4.4.5 Settings CheckMaintenance.php getValueAttribute maintenance_message deserialization

Summaryinfo

A vulnerability identified as problematic has been detected in TastyIgniter up to 4.4.5. Affected by this vulnerability is the function getValueAttribute of the file CheckMaintenance.php of the component Settings. Performing a manipulation of the argument maintenance_message results in deserialization. This vulnerability is reported as CVE-2026-29001. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in TastyIgniter up to 4.4.5. This affects the function getValueAttribute of the file CheckMaintenance.php of the component Settings. The manipulation of the argument maintenance_message with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-29001 since 03/03/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are required for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2026).

By approaching the search of inurl:CheckMaintenance.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• TastyIgniter

Version

• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 4.4.5

Website

• Product: https://github.com/tastyigniter/TastyIgniter/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion