An attacker who can access the administration console of Chyrp Lite or obtain Change Settings permissions can alter the uploads path to any directory on the server. This path traversal flaw permits downloading arbitrary files, including sensitive configuration files that store database credentials, and the overwriting of critical system files. Such manipulation leads to complete control over the application, enabling the execution of arbitrary code on the host.

The vulnerability affects instances of the Chyrp Lite blogging engine that are running versions prior to 2026.01. The vendor is Xenocrat, and the product name is Chyrp Lite.

The assessed CVSS score of 9.1 indicates a high severity condition, while the EPSS score of less than 1% suggests current exploitation attempts are rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the admin area, but once granted, an attacker can trigger remote code execution by uploading malicious content or overwriting essential files. Given the potential impact and the availability of a patch, this flaw represents a critical risk for affected deployments.