This vulnerability is a PHP Object Injection flaw, classified as CWE‑502, that allows an authenticated administrator to submit a serialized PHP object as a value for an application setting. The object is stored without sanitization and later unserialized by getValueAttribute() when the setting is read, permitting the attacker to craft a gadget chain (for example generated via phpggc) that executes arbitrary operating‑system commands as the PHP application process user. The attack can be performed through the admin settings form, such as the maintenance_message setting loaded by CheckMaintenance.php, and the malicious command execution persists until the setting value is overwritten.

All installations of the TastyIgniter application up to and including version 4.4.5 are affected. The weakness can be triggered via the admin settings interface, for example by modifying the maintenance_message setting loaded by CheckMaintenance.php. Versions newer than 4.4.5 are presumed to have the bug removed.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score of 0.00786 (<1%) indicates a very low exploitation probability, but the lack of a presence in the KEV catalog does not negate the high risk; attackers still benefit from authenticated administrator access. An attacker that compromises an admin account can exploit the flaw immediately by submitting a serialized gadget chain through the settings form. The flaw is exploitable without needing network-level exposure beyond the web application and persists as long as the malicious setting value remains on the server.