Chyrp Lite versions before 2026.01 contain a path traversal vulnerability in the administration console. Users with Change Settings permission can change the uploads directory path to any folder on the server. This flaw allows unauthorized access to sensitive files like config.json.php and the ability to overwrite system files, which can result in remote code execution. The vulnerability is tracked as CVE-2026-35174 with a CVSS 3.1 score of 9.1 (critical). The issue is resolved in version 2026.01.

An attacker with administrative or Change Settings privileges can exploit this vulnerability to read sensitive files including those with database credentials and overwrite critical system files. This can lead to full remote code execution on the affected server, compromising confidentiality, integrity, and availability.

Upgrade Chyrp Lite to version 2026.01 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated or required as the vendor has provided an official fix.