Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-35174Chyrp Lite has a Path Traversal to Remote Code Execution

Critical 9.1

In plain English

A critical-severity path traversal in chyrp-lite from xenocrat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 52.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01.

Affected products (as reported)

Vendor	Product	Versions
xenocrat	chyrp-lite	< 2026.01

Weakness: CWE-22, CWE-73, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257 x_refsource_CONFIRM