CVE-2026-53767 & CVE-2026-53768: Authenticated RCE via Chained Upload Path Bypass in Chyrp Lite

Summary

CVE-2026-53767 and CVE-2026-53768 affect Chyrp Lite versions up to and including 2026.01 ("Iriomote"). Two independent logic flaws, when chained, allow an authenticated administrator to achieve Remote Code Execution on the server as the web server user (www-data).

The first weakness (CVE-2026-53768) allows an administrator to redirect the application's upload directory to tools/ - a directory containing executable PHP files - because the blocklist used to validate uploads_path is incomplete. The second weakness (CVE-2026-53767) allows the content of an existing file to be replaced via the admin_update_upload() handler without any validation of the uploaded file's extension. On its own, each weakness has limited or no direct code execution impact. Chained together, they yield a complete RCE primitive.

CVSS Score: 9.1 Critical | CVE: CVE-2026-53767 · CVE-2026-53768 | GHSA-8h86-c24h-5jp3 · GHSA-r9w7-5h94-wq5x | Author: iltosec

Vulnerability Details

CVE-2026-53768 - Incomplete uploads_path Blocklist

includes/controller/Admin.php (lines ~3538–3543) validates the user-supplied uploads_path value against a hardcoded blocklist of protected directories:

admin | ajax | feathers | fonts | includes | modules | themes

The tools/ directory - which ships with every Chyrp Lite installation and contains executable PHP files including docgen.php, gettext.php, and triggers.php - is not present in this list. Submitting uploads_path=tools passes both normalization regexes unchanged and is written to config.json.php. From this point forward, all upload and overwrite operations are directed to tools/ instead of the intended uploads directory.

As a secondary effect, once uploads_path is redirected, the admin panel's file listing exposes the contents of tools/ - allowing an authenticated administrator to view and download PHP source files that are not intended to be accessible through the UI.

CVE-2026-53767 - Missing Extension Validation in admin_update_upload()

The admin_update_upload() handler resolves the target filename from $_POST['file'] against the current uploads_path, verifies the file exists via is_file(), and then overwrites it with the uploaded content. The gate for this operation is upload_tester() (includes/helpers.php, ~lines 3251–3329), which only checks the PHP upload error code and the file size. It performs no extension or MIME type validation on the replacement file.

The overwrite preserves the original filename and extension of the target - it does not rename the file. In the default configuration, this has no practical code execution impact: the uploads directory contains only non-executable files (.jpg, .png, etc.), and Apache only executes files matching .ph(ar|p|tml). Overwriting a .jpg with PHP content does not lead to execution.

This constraint is eliminated once CVE-2026-53768 redirects uploads_path to tools/, where docgen.php - a web-executable PHP file - already exists.

PoC

Chained Impact - Remote Code Execution

The execution environment on the test system:

# /etc/apache2/mods-available/php8.4.conf
<FilesMatch "\.ph(?:ar|p|tml)$">
    SetHandler application/x-httpd-php
</FilesMatch>

With disable_functions empty, all PHP functions including system(), exec(), and passthru() are available. The complete attack chain is:

1. Authenticate as an administrator
2. Set uploads_path to tools via Content Settings (CVE-2026-53768 - not blocked)

3. Upload a PHP webshell as the replacement for tools/docgen.php (CVE-2026-53767 - no extension check)

4. Request http://target/chyrp/tools/docgen.php?cmd=id

A full exploit script implementing the above attack chain is available at:

https://github.com/iltosec/chyrp-lite-rce-poc

The script supports a default recon mode, single-command execution, and an interactive shell. Cleanup is handled automatically - docgen.php is restored and uploads_path is reset after exploitation.

# Interactive shell
python chyrp_rce_poc.py -u http://target/chyrp -U admin -P 'password' -i

# Single command
python chyrp_rce_poc.py -u http://target/chyrp -U admin -P 'password' -c 'id'

Impact

Any user holding change_settings and edit_upload permissions - the Administrator role by default - can execute arbitrary OS commands as the web server user. This bridges the boundary from CMS management to complete OS-level control:

• Data Exfiltration: Access to all site content, user credentials, and database configurations
• Persistence: Ability to drop web shells and backdoors in writable directories
• Pivoting: Access to internal network services from the compromised server

Fix

Update to a version containing commit 1489dc9 or later. Both fixes must be applied - neither is sufficient on its own.

Fix 1 - Add tools and licenses to the uploads_path blocklist (includes/controller/Admin.php):

// Before
"/^$qdir((admin|ajax|feathers|fonts|includes|modules|themes)$qdir|$)/"

// After
"/^$qdir((admin|ajax|feathers|fonts|includes|licenses|modules|themes|tools)$qdir|$)/"

Fix 2 - Validate the uploaded file's extension against the whitelist in admin_update_upload() (includes/helpers.php, ~line 2068):

$new_extension = strtolower(pathinfo($_FILES['upload']['name'], PATHINFO_EXTENSION));
$whitelist = upload_filter_whitelist();
if (!in_array($new_extension, $whitelist))
    error(__("Error"), __("File type is not allowed."), code: 422);

Disclosure Timeline

References

• GHSA-8h86-c24h-5jp3 - Missing extension validation (CVE-2026-53767)
• GHSA-r9w7-5h94-wq5x - Incomplete blocklist (CVE-2026-53768)
• Fix commit 1489dc9
• PoC - github.com/iltosec/chyrp-lite-rce-poc