Chyrp Lite versions before 2026.01 contain a path traversal vulnerability in the administration console. Users with Change Settings permission can change the uploads directory path arbitrarily, enabling them to access and download any file on the server, including sensitive configuration files, and overwrite critical system files. This can lead to remote code execution. The vulnerability is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), with related weaknesses CWE-73 and CWE-434. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The issue is resolved in Chyrp Lite version 2026.01.

An attacker with administrator or Change Settings privileges can exploit this vulnerability to read any file on the server, including sensitive files like config.json.php containing database credentials, and overwrite critical system files. This can lead to full remote code execution, compromising the confidentiality, integrity, and availability of the affected system.

Upgrade Chyrp Lite to version 2026.01 or later, where this vulnerability is fixed. No other mitigation guidance is provided or necessary as the fix addresses the root cause.