CVE-2026-35174 - Vulnerability Analysis

Overview

Chyrp Lite < 2026.01 contains a path traversal caused by improper validation of uploads path in the administration console, letting administrators or users with Change Settings permission read and overwrite arbitrary files, exploit requires Change Settings permission.

Severity & Score

Impact

Authorized users can read sensitive files and overwrite system files, potentially leading to remote code execution and full system compromise.

Mitigation

Update to version 2026.01 or later.

References

• https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner