CVE-2026-29001

{
  "etk_id": "ETK-2026-2442",
  "cve_id": "CVE-2026-29001",
  "display_id": "CVE-2026-29001",
  "ghsa_id": "GHSA-736x-jrr3-jq2x",
  "euvd_id": "EUVD-2026-107571",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe PHP deserialization in TastyIgniter settings",
  "summary": "TastyIgniter through 4.4.5 can deserialize untrusted data stored in application settings. An authenticated administrator able to modify settings may cause code to run as the PHP application user when the affected setting is read.",
  "mitigation": "Restrict settings administration to fully trusted accounts and review or replace suspicious serialized setting values. Upgrade to a vendor-corrected release once its fixed version is confirmed.",
  "vendor": "tastyigniter",
  "product": "TastyIgniter",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.4.5"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "TastyIgniter",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 22.75154365,
  "t0_at": "2026-10-21T21:03:25.481000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-22T13:55:33.788379+00:00",
      "days": 0.7028739279976852,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T21:03:25.481000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-21T21:03:25.481000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T21:03:25.481000+00:00",
      "url": "https://github.com/advisories/GHSA-736x-jrr3-jq2x"
    }
  }
}