PT-2026-30695 · Unknown · Chyrp Lite

Whoamins · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35174

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chyrp Lite versions prior to 2026.01

Description Chyrp Lite, an ultra-lightweight blogging engine, contains a path traversal vulnerability in the administration console. This allows an administrator or a user with Change Settings permission to modify the uploads path to any folder on the server. Successful exploitation enables downloading sensitive files, such as config.json.php containing database credentials, and overwriting critical system files, potentially leading to remote code execution.

Recommendations Versions prior to 2026.01 should be updated to version 2026.01.

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

CWE-73

Related Identifiers

CVE-2026-35174

Affected Products

Chyrp Lite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-35174 · Security Note
• https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257 · Note
• https://twitter.com/0dayPublishing/status/2041216774272643152 · Twitter Post
• https://twitter.com/CveFindCom/status/2041225273543172178 · Twitter Post
• https://twitter.com/CVEnew/status/2041223944435269653 · Twitter Post