CVE-2026-35174

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35174", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T17:26:21.133Z", "datePublished": "2026-04-06T17:50:04.544Z", "dateUpdated": "2026-04-07T14:38:40.034Z"}, "containers": {"cna": {"title": "Chyrp Lite has a Path Traversal to Remote Code Execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257"}], "affected": [{"vendor": "xenocrat", "product": "chyrp-lite", "versions": [{"version": "< 2026.01", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:50:04.544Z"}, "descriptions": [{"lang": "en", "value": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01."}], "source": {"advisory": "GHSA-p6pf-2grm-8257", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T14:38:27.814305Z", "id": "CVE-2026-35174", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:38:40.034Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35174", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T14:38:27.814305Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:38:36.147Z"}}], "cna": {"title": "Chyrp Lite has a Path Traversal to Remote Code Execution", "source": {"advisory": "GHSA-p6pf-2grm-8257", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "xenocrat", "product": "chyrp-lite", "versions": [{"status": "affected", "version": "< 2026.01"}]}], "references": [{"url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257", "name": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T17:50:04.544Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35174", "state": "PUBLISHED", "dateUpdated": "2026-04-07T14:38:40.034Z", "dateReserved": "2026-04-01T17:26:21.133Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T17:50:04.544Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "chyrp-lite", "vendor": "xenocrat", "versions": [{"status": "affected", "version": "< 2026.01"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chyrplite:chyrp_lite:*:*:*:*:*:*:*:*", "matchCriteriaId": "A06975FD-D52C-42B2-8842-7626FCA5A94E", "versionEndExcluding": "2026.01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01."}, {"lang": "es", "value": "Chyrp Lite es un motor de blogs ultraligero. Antes de 2026.01, existe una vulnerabilidad de salto de ruta en la consola de administraci\u00f3n que permite a un administrador o a un usuario con permiso de Cambiar Configuraci\u00f3n cambiar la ruta de subidas a cualquier carpeta. Esta vulnerabilidad permite al usuario descargar cualquier archivo en el servidor, incluyendo config.json.php con credenciales de base de datos y sobrescribir archivos cr\u00edticos del sistema, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo. Esta vulnerabilidad est\u00e1 corregida en 2026.01."}], "id": "CVE-2026-35174", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35174", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T14:38:27.814305Z", "version": "2.0.3"}}]}, "published": "2026-04-06T18:16:43.677", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.01)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "chyrp-lite", "source": "cna", "vendor": "xenocrat"}, "product": "chyrp-lite", "vendor": "xenocrat_project"}], "analysis": {"en": {"generated_at": "2026-04-14T16:32:27.708074+00:00", "value": {"mitigation_remediation": ["Upgrade Chyrp Lite to version 2026.01 or later", "Restrict Change Settings permissions to trusted administrators only", "Verify file system permissions to ensure config.json.php and other critical files are not writable by the web server", "Monitor the uploads directory for unauthorized modifications"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects instances of the Chyrp Lite blogging engine that are running versions prior to 2026.01. The vendor is Xenocrat, and the product name is Chyrp Lite.", "description_and_impact": "An attacker who can access the administration console of Chyrp Lite or obtain Change Settings permissions can alter the uploads path to any directory on the server. This path traversal flaw permits downloading arbitrary files, including sensitive configuration files that store database credentials, and the overwriting of critical system files. Such manipulation leads to complete control over the application, enabling the execution of arbitrary code on the host.", "risk_and_exploitability": "The assessed CVSS score of 9.1 indicates a high severity condition, while the EPSS score of less than 1% suggests current exploitation attempts are rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the admin area, but once granted, an attacker can trigger remote code execution by uploading malicious content or overwriting essential files. Given the potential impact and the availability of a patch, this flaw represents a critical risk for affected deployments."}}}}, "created": "2026-04-07T06:54:50.435051+00:00", "updated": "2026-04-14T16:41:12.126575+00:00", "vendors": ["xenocrat_project", "xenocrat_project$PRODUCT$chyrp-lite"]}