iltosec/chyrp-lite-rce-pocCVE-2026-53767 + CVE-2026-53768 - Authenticated RCE in Chyrp Lite ≤ 2026.01 via uploads_path blocklist bypass and missing extension validation
CVE-2026-53767 + CVE-2026-53768 - Authenticated RCE in Chyrp Lite ≤ 2026.01 ("Iriomote")
Chained attack:
uploads_pathblocklist bypass (CVE-2026-53768) + missing file extension validation inadmin_update_upload()(CVE-2026-53767) → Remote Code Execution aswww-data
Chyrp Lite ≤ 2026.01 is vulnerable to an authenticated Remote Code Execution chain exploitable by any user holding change_settings and edit_upload permissions (default: Administrator).
| CVE | CVE-2026-53767 · CVE-2026-53768 |
| CVSS | 9.1 Critical (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) |
| Affected | xenocrat/chyrp-lite ≤ 2026.01 |
| Patched | commit 1489dc9 |
| Advisories | GHSA-8h86-c24h-5jp3 · GHSA-r9w7-5h94-wq5x |
| Reporter | iltosec |
python chyrp_rce_poc.py -h
usage: chyrp_rce_poc.py [-h] -u URL -U USERNAME -P PASSWORD [-c CMD] [-i]
[--config CONFIG] [--restore RESTORE]
python chyrp_rce_poc.py -u http://127.0.0.1/chyrp -U admin -P 'fJ945@5:3s8v+X:'
python chyrp_rce_poc.py -u http://127.0.0.1/chyrp -U admin -P 'fJ945@5:3s8v+X:' -c 'cat /etc/passwd'
python chyrp_rce_poc.py -u http://127.0.0.1/chyrp -U admin -P 'fJ945@5:3s8v+X:' -i
Step 1 - Authenticate
Step 2 - Redirect uploads_path to tools/ (not in blocklist)
image
image
Step 3 - Overwrite tools/docgen.php (no extension check on replacement)
image
image
Step 4 - Execute
http://127.0.0.1/chyrp/tools/docgen.php?cmd=id
image
uploads_path blocklistincludes/controller/Admin.php validates uploads_path against a hardcoded blocklist:
admin | ajax | feathers | fonts | includes | modules | themes
The tools/ directory - which ships with Chyrp Lite and contains executable .php files (docgen.php, gettext.php, triggers.php) - is not listed. Submitting uploads_path=tools passes validation and is persisted to config.json.php.
admin_update_upload()upload_tester() (includes/helpers.php) only checks the PHP upload error code and file size - it performs no extension validation on the replacement file. The target filename is taken from $_POST['file'] and resolved against the current uploads_path. Since tools/docgen.php already exists (satisfying the is_file() check), it is silently overwritten with arbitrary content.
Note: The
--configflag points toconfig.json.phpfor CSRF token computation. If the file is not locally readable, the script falls back to extracting the token from the HTML response automatically.
Update to a version containing commit 1489dc9 or later.
Two independent fixes were applied:
Fix 1 - Add tools (and licenses) to the uploads_path blocklist:
// Before
"/^$qdir((admin|ajax|feathers|fonts|includes|modules|themes)$qdir|$)/"
// After
"/^$qdir((admin|ajax|feathers|fonts|includes|licenses|modules|themes|tools)$qdir|$)/"
Fix 2 - Validate the uploaded file's extension against the whitelist in admin_update_upload():
$new_extension = strtolower(pathinfo($_FILES['upload']['name'], PATHINFO_EXTENSION));
$whitelist = upload_filter_whitelist();
if (!in_array($new_extension, $whitelist))
error(__("Error"), __("File type is not allowed."), code: 422);
This PoC is released for educational and research purposes only. Use only against systems you own or have explicit written permission to test. The author is not responsible for any misuse.