Chyrp Lite
Monthly
Path traversal in Chyrp Lite administration console allows privileged users with Change Settings permissions to manipulate the uploads path, enabling arbitrary file read (including database credentials from config.json.php) and arbitrary file write leading to remote code execution. Affects all versions prior to 2026.01. CVSS 9.1 (Critical) reflects post-authentication impact with scope change. EPSS data not available; no public exploit identified at time of analysis, no CISA KEV listing.
Chyrp Lite prior to version 2026.01 allows authenticated users with post editing permissions to modify posts owned by other users through an insecure direct object reference (IDOR) and mass assignment vulnerability in the Post model. Attackers can inject internal class properties such as post IDs into the post_attributes payload to alter which post is being edited, effectively enabling unauthorized post takeover. The vulnerability requires valid authentication and existing post editing permissions but no user interaction, posing a medium-to-high integrity risk to multi-user blogging instances.
Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path traversal in Chyrp Lite administration console allows privileged users with Change Settings permissions to manipulate the uploads path, enabling arbitrary file read (including database credentials from config.json.php) and arbitrary file write leading to remote code execution. Affects all versions prior to 2026.01. CVSS 9.1 (Critical) reflects post-authentication impact with scope change. EPSS data not available; no public exploit identified at time of analysis, no CISA KEV listing.
Chyrp Lite prior to version 2026.01 allows authenticated users with post editing permissions to modify posts owned by other users through an insecure direct object reference (IDOR) and mass assignment vulnerability in the Post model. Attackers can inject internal class properties such as post IDs into the post_attributes payload to alter which post is being edited, effectively enabling unauthorized post takeover. The vulnerability requires valid authentication and existing post editing permissions but no user interaction, posing a medium-to-high integrity risk to multi-user blogging instances.
Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.