Executive brief
Chyrp Lite is a lightweight blogging platform. A security flaw in its administration console allows users with high-level permissions to change the system's file upload path to any folder on the server. This can be used to steal sensitive configuration files containing database passwords or to overwrite system files, potentially allowing an attacker to take full control of the server.
Technical details
A path traversal vulnerability exists in the AdminController of Chyrp Lite due to incomplete filtering of directory traversal sequences. While the application attempts to filter input, it fails to account for absolute paths and non-recursive filtering (e.g., '...../' resolving to '../'). An authenticated attacker with 'Change Settings' permissions can redefine the uploads directory to the root or sensitive system directories. By leveraging download.php and the admin_update_upload() action, the attacker can then perform arbitrary file disclosure (such as reading database credentials in config.json.php) or overwrite executable PHP files to achieve remote code execution (RCE). The issue is resolved in version 2026.01 by disallowing backtracking components and blacklisting internal directories.
Affected products
- xenocrat Chyrp Lite < 2026.01
Timeline
- 2026-03-14: advisory: Vendor advisory published on GitHub
- 2026-04-06: disclosed: CVE published to NVD
- 2026-01: patched: Vulnerability fixed in version 2026.01