CVE-2026-35174
Critical
Description
Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01.
SeverityCritical
CVSS9.1
Exploit probability—
ProductChyrplite Chyrp Lite
PublishedApr 6, 2026
First seenApr 6, 2026
How to fix
Update
- chyrplite chyrp_lite2026.01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chyrplite chyrp_lite | v < 2026.01 | 2026.01 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.