CVE-2026-35174
Chyrp Lite has a Path Traversal to Remote Code Execution
CVSS Score
9.1
EPSS Score
0.3%
EPSS Percentile
57th
Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01.
| CWE | CWE-22 CWE-73 CWE-434 |
| Vendor | xenocrat |
| Product | chyrp-lite |
| Published | Apr 6, 2026 |
| Last Updated | Apr 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for xenocrat chyrp-lite
Be the first to know when new critical vulnerabilities affecting xenocrat chyrp-lite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
xenocrat / chyrp-lite
< 2026.01