Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01.
A user with administrator role or 'Change Settings' permission can change the uploaded files directory path (uploads path) to any directory in the server's file system. The lack of proper validation and sanitization of this path (CWE-22, CWE-73) combined with file upload capability (CWE-434) allows an attacker to download any file from the server — including the config.json.php file containing database credentials — and to overwrite critical system files. Overwriting key application or server files directly leads to remote code execution.
An attacker can read sensitive configuration data (including database credentials) and overwrite critical system files, leading to complete server takeover through remote code execution (RCE).
Update Chyrp Lite to version 2026.01, where the vulnerability has been fixed. Details are available in the vendor's references: https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257
Chyrp Lite in all versions before 2026.01. Exploitation of the vulnerability requires having an account with administrator permissions or 'Change Settings' permission.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HChyrplite Chyrp Lite
APPChyrplite< 2026.01