TastyIgniter CVE-2026-29001

Exploitation requires valid TastyIgniter administrator authentication with access to the admin settings form - this is the primary limiting factor (CVSS PR:H). The specific prerequisite is the ability to write a settings value (e.g. the maintenance_message setting consumed by CheckMaintenance.php) that is stored unsanitized and later passed to getValueAttribute(), which unserializes it. A usable PHP gadget chain must exist in the application's loaded code/dependencies (such as one produced by phpggc) for the deserialization to reach code execution. No user interaction beyond the attacker's own form submission is needed (UI:N), and the affected setting path appears present in default installations through version 4.4.5, so no non-default configuration is required once admin access is held. Execution occurs as the PHP application process user, and impact persists until the malicious setting value is overwritten.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, impact VC:H/VI:H/VA:H, score 8.6) describes network-reachable, low-complexity exploitation that nonetheless requires high privileges (PR:H) - consistent with the description's statement that only 'authenticated administrators' can trigger it. This single gating factor is the dominant risk discriminator: the flaw yields full arbitrary OS command execution, but only to an actor who already holds admin credentials on the TastyIgniter back office. No EPSS score was provided, the CVE is not present in CISA KEV, and no CVE-specific public exploit is referenced - so there is no public exploit identified at time of analysis, although the description explicitly notes the attack is achievable with gadget chains from the well-known public phpggc tool, lowering the practical skill barrier once admin access is obtained. The deserialization sink (getValueAttribute() unserializing a stored setting) is confirmed by the VulnCheck advisory and the upstream GitHub issue. Net: this is a genuine high-severity post-authentication RCE but not an unauthenticated internet-facing emergency - treat as a privilege-escalation / insider-and-compromised-admin concern rather than a mass-exploitation threat. Note the signals are internally consistent (no CVSS-vs-description conflict); the main missing data points are EPSS probability and any confirmation of in-the-wild use.

An attacker who has obtained administrator access to the TastyIgniter admin panel (via phishing, credential reuse, or an insider) generates a PHP gadget chain with phpggc and submits it as a settings value such as maintenance_message. When the setting is next read, getValueAttribute() unserializes the attacker's object, executing the gadget chain and running arbitrary OS commands as the PHP process user. No CVE-specific public exploit is referenced, but the described phpggc-based technique is low-complexity for a skilled actor.