Path Traversal Vulnerability in Chyrp Lite Blogging Engine

CVE-2026-35174

What is CVE-2026-35174?

Chyrp Lite, an ultra-lightweight blogging engine, contains a path traversal vulnerability in its administration console, allowing users with the 'Change Settings' permission to alter the uploads path to any directory on the server. This serious flaw enables unauthorized access to server files, potentially leading to the exposure of sensitive information such as database credentials stored in 'config.json.php', and may allow the malicious overwriting of critical system files, resulting in remote code execution. The issue has been addressed in version 2026.01.

References