CVE-2026-35174

OVERVIEW Chyrp Lite, an ultra-lightweight blogging engine, contains a path traversal vulnerability in its administration console affecting versions prior to 2026.01. The flaw allows administrators or users with Change Settings permissions to modify the uploads path to arbitrary server directories, enabling unauthorized file access and modification. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.2 (HIGH) with network-based attack vector, low complexity, and high privilege requirements. The impact is severe, permitting attackers to read sensitive files such as config.json.php containing database credentials and overwrite critical system files to achieve remote code execution. The FAUCET Risk Score of 47.0/100 indicates moderate overall risk. EXPLOITATION STATUS The vulnerability is not currently being actively exploited based on available indicators. It does not appear on the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.0046 suggests minimal probability of exploitation in the wild, though the vulnerability's critical nature warrants prompt patching to Chyrp Lite version 2026.01 or later.