Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/71702?format=api",
    "vulnerability_id": "VCID-2rsc-y6p8-vbh8",
    "summary": "Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download any file on the server, including config.json.php with database credentials and overwrite critical system files, leading to remote code execution. This vulnerability is fixed in 2026.01.",
    "aliases": [
        {
            "alias": "CVE-2026-35174"
        }
    ],
    "fixed_packages": [],
    "affected_packages": [],
    "references": [
        {
            "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35174",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "0.00496",
                    "scoring_system": "epss",
                    "scoring_elements": "0.66266",
                    "published_at": "2026-06-11T12:55:00Z"
                },
                {
                    "value": "0.00496",
                    "scoring_system": "epss",
                    "scoring_elements": "0.6636",
                    "published_at": "2026-06-12T12:55:00Z"
                },
                {
                    "value": "0.00519",
                    "scoring_system": "epss",
                    "scoring_elements": "0.67313",
                    "published_at": "2026-06-13T12:55:00Z"
                }
            ],
            "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35174"
        },
        {
            "reference_url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257",
            "reference_id": "GHSA-p6pf-2grm-8257",
            "reference_type": "",
            "scores": [
                {
                    "value": "9.1",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
                },
                {
                    "value": "Track",
                    "scoring_system": "ssvc",
                    "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-07T14:38:27Z/"
                }
            ],
            "url": "https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-p6pf-2grm-8257"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 22,
            "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
            "description": "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."
        },
        {
            "cwe_id": 73,
            "name": "External Control of File Name or Path",
            "description": "The product allows user input to control or influence paths or file names that are used in filesystem operations."
        },
        {
            "cwe_id": 434,
            "name": "Unrestricted Upload of File with Dangerous Type",
            "description": "The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment."
        }
    ],
    "exploits": [],
    "severity_range_score": "9.1 - 9.1",
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2rsc-y6p8-vbh8"
}