CVE-2026-29001: TastyIgniter PHP Object Injection RCE

CVE-2026-29001 Overview

CVE-2026-29001 is a PHP object injection vulnerability affecting TastyIgniter through version 4.4.5. Authenticated administrators can submit a serialized PHP object as a settings value through the admin interface. TastyIgniter stores the value without sanitization and later deserializes it when the setting is read by getValueAttribute(). Attackers who leverage a gadget chain, such as one generated by phpggc, can achieve arbitrary operating system command execution as the PHP application process user. The impact persists until the malicious serialized value is overwritten, giving attackers reliable code execution on the host.

Critical Impact

Authenticated administrators can achieve persistent remote code execution on the TastyIgniter host as the PHP process user through unsafe deserialization of settings values [CWE-502].

Affected Products

• TastyIgniter through 4.4.5
• Deployments using the admin settings interface (for example, maintenance_message loaded by CheckMaintenance.php)
• PHP application servers hosting vulnerable TastyIgniter instances

Discovery Timeline

• 2026-10-21 - CVE-2026-29001 published to the National Vulnerability Database (NVD)
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-29001

Vulnerability Analysis

TastyIgniter persists administrator-supplied settings as serialized PHP values in its database layer. When a setting is read, the accessor getValueAttribute() calls PHP's unserialize() on the stored value without validating the object graph. An authenticated administrator can submit a crafted serialized object through any settings form, including maintenance_message, and trigger deserialization on the next read.

The vulnerability falls under the Insecure Deserialization class [CWE-502]. PHP object injection becomes exploitable when the application loads classes containing magic methods such as __destruct, __wakeup, or __toString that perform sensitive operations. Tools like phpggc provide ready-made gadget chains for common frameworks and libraries bundled with TastyIgniter, turning object injection into reliable command execution.

Root Cause

The root cause is unconditional invocation of unserialize() on attacker-controlled input stored in the settings table. The getValueAttribute() accessor does not restrict allowed classes, validate the serialized structure, or use a safer encoding such as JSON. Any serialized payload written by an administrator is reconstructed into live PHP objects at read time.

Attack Vector

Exploitation requires valid administrator credentials and network access to the admin panel. An attacker generates a gadget chain targeting a library present in the TastyIgniter dependency tree, submits the serialized payload through the settings form (for example, as the maintenance_message value), and waits for the setting to be loaded. CheckMaintenance.php reads the maintenance message during normal request processing, triggering deserialization and executing the gadget chain. Command execution runs with the privileges of the PHP application process user. The malicious value remains in the database and continues to trigger execution until overwritten.

See the VulnCheck Advisory on TastyIgniter and the GitHub Issue Comment for additional technical detail.

Detection Methods for CVE-2026-29001

Indicators of Compromise

• Settings rows in the TastyIgniter database containing PHP serialized object markers such as O: followed by a class name and length prefix
• Unexpected child processes spawned by the PHP-FPM or web server worker (for example, sh, bash, curl, wget, nc)
• Outbound network connections initiated by the PHP application process to unfamiliar hosts following administrator settings changes
• Modifications to maintenance_message or other settings values immediately followed by anomalous process execution

Detection Strategies

• Inspect the settings storage table for values beginning with serialization tokens (O:, a:, s:) where plain strings are expected
• Correlate administrator login events with subsequent settings updates and child process creation on the web server
• Monitor for calls to unserialize() in application traces that process settings values
• Alert on web server processes executing shell interpreters or scripting binaries

Monitoring Recommendations

• Enable PHP audit logging for calls into getValueAttribute() and surrounding settings read paths
• Forward web server, PHP-FPM, and host process telemetry into a centralized analytics platform for cross-source correlation
• Baseline normal administrator activity and alert on deviations such as off-hours settings edits or edits from new source IPs

How to Mitigate CVE-2026-29001

Immediate Actions Required

• Audit the TastyIgniter settings table and remove any values containing PHP serialization markers that were not written by the application itself
• Restrict administrator accounts to trusted operators and enforce multi-factor authentication on the admin panel
• Place the TastyIgniter admin interface behind network access controls such as VPN or IP allowlisting
• Rotate credentials and secrets accessible to the PHP application user if exploitation is suspected

Patch Information

No vendor patch is referenced in the current NVD entry for CVE-2026-29001. Monitor the TastyIgniter GitHub repository and the VulnCheck Advisory on TastyIgniter for fix availability. Upgrade to a version later than 4.4.5 once the maintainer publishes a release that replaces unserialize() with safe encoding or enforces an allowlist of classes.

Workarounds

• Replace serialized storage of settings with JSON encoding in a local fork until an upstream fix ships
• Pass an allowed_classes option to any unserialize() call that processes settings data, restricting deserialization to a minimal safe set
• Remove or disable settings fields such as maintenance_message that are not operationally required
• Deploy a web application firewall rule to block administrator form submissions containing PHP serialization tokens

# Example: scan settings table for serialized PHP objects
mysql -u tastyigniter -p tastyigniter_db -e \
  "SELECT item, value FROM settings WHERE value LIKE 'O:%' OR value LIKE 'a:%:{%';"