CVE-2026-35174 Chyrp Lite has a Path Traversal to Remote Code Execution
Administrators can exploit path traversal to read sensitive files and overwrite system files, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35174?
CVE-2026-35174 is a critical path traversal vulnerability in xenocrat chyrp-lite, published on 6 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01.
Which versions are affected by CVE-2026-35174?
It affects 1 product.
Products include Chyrplite Chyrp Lite.
How do I fix CVE-2026-35174?
No fix has been published for CVE-2026-35174 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-35174 being exploited?
There is no known exploitation of CVE-2026-35174 in the wild and no public exploit code.
Other vulnerabilities in xenocrat chyrp-lite
Sources
Also known as GHSA-p6pf-2grm-8257.