CVE-2026-35174

Chyrp Lite has a Path Traversal to Remote Code Execution

State: Published
Severity: 9.1 Critical
Published: Apr 6, 2026
Updated: Apr 7, 2026
Reserved: Apr 1, 2026

Description

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 External Control of File Name or Path
CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
chyrp-litexenocrat	< 2026.01Affected

References

https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.