PT-2026-30695 · Unknown · Chyrp Lite

Whoamins · CVE-2026-35174 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chyrp Lite versions prior to 2026.01

Description Chyrp Lite, an ultra-lightweight blogging engine, contains a path traversal vulnerability in the administration console. This allows an administrator or a user with Change Settings permission to modify the uploads path to any folder on the server. Successful exploitation enables downloading sensitive files, such as config.json.php containing database credentials, and overwriting critical system files, potentially leading to remote code execution.

Recommendations Versions prior to 2026.01 should be updated to version 2026.01.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-73

CWE-434

CWE-22

Related Identifiers

CVE-2026-35174

GHSA-P6PF-2GRM-8257

Affected Products

Chyrp Lite

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35174.json · Exploit
• https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35174 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35174 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/2041216774272643152 · Twitter Post
• https://twitter.com/CVEnew/status/2041223944435269653 · Twitter Post
• https://twitter.com/CveFindCom/status/2041225273543172178 · Twitter Post