CVE-2026-35174
Chyrp Lite, a lightweight blogging engine, had a path traversal flaw in its admin console that let privileged users change the uploads directory to any location. This allowed them to read any server file, steal credentials, overwrite critical files, and run arbitrary code. The issue is fixed in version 2026.01.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Chyrp Lite installations older than version 2026.01, typically small blogs and personal websites.
Real-world impact
An attacker who can log in as an administrator or a user with Change Settings permission can download any file on the server, including configuration files with database credentials, and overwrite system files, leading to full remote code execution.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability can be exploited remotely with low effort, requires only high privileges (admin or Change Settings), and gives attackers complete control over the system, which is why it is rated critical.
What to do about it
- 01Upgrade Chyrp Lite to version 2026.01 or later.
- 02Restart the web server or application after the upgrade.
NVD-referenced vendor advisory
Timeline
- Apr 6, 2026 · Apr 6, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/xenocrat/chyrp-lite/securit…vendor advisory