CVE-2026-35174 - Vulnerability Analysis

Overview

Chyrp Lite < 2026.01 contains a path traversal caused by improper validation of uploads path in the administration console, letting administrators or users with Change Settings permission read and overwrite arbitrary files, exploit requires Change Settings permission.

Severity & Score

Impact

Authorized users can read sensitive files and overwrite system files, potentially leading to remote code execution and full system compromise.

Mitigation

Update to version 2026.01 or later.

References

• https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 6, 2026

🔴 CVE-2026-35174 - Critical (9.1) Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any fold... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35174/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner