Review reviewHigh

CVE-2026-35174

xenocrat chyrp-lite, chyrp lite

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01.

CVSS: 7.2
EPSS: 0.56%
CISA KEV: Not listed
Published: 2026.04.07

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.56%

Technical severityCVSS 7.2

Vulnerability overview

Affected product and versions

Product: xenocrat chyrp-lite, chyrp lite
Affected versions: >= < 2026.01, < 2026.01
Fixed versions: 2026.01

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that xenocrat chyrp-lite, chyrp lite and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-22, CWE-434, CWE-73