Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a ..…

1. 2011-07-19 Published
2. 2011-07-29 First public exploit (EDB-35946)

12.99% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

• EDB-35946 Chyrp 2.x - '/includes/lib/gz.php?File' Traversal Arbitrary File Access webapps, 2011-07-29
• Nuclei template Chyrp 2.x - Local File Inclusion nuclei detection template
• justanotherhacker.com http://www.justanotherhacker.com/advisories/JAHx113.txt referenced PoC, tagged "exploit" by a source, unverified
• securityfocus.com http://www.securityfocus.com/bid/48672 referenced PoC, tagged "exploit" by a source, unverified
• openwall.com http://www.openwall.com/lists/oss-security/2011/07/13/6 referenced PoC, tagged "exploit" by a source, unverified
• openwall.com http://www.openwall.com/lists/oss-security/2011/07/13/5 referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-22 Improper Limitation of a Pathname to a Restricted Directory

• justanotherhacker.com /advisories/JAHx113.txt

  exploit

• securityfocus.com /bid/48672

  vdb-entry, exploit

• openwall.com /lists/oss-security/2011/07/13/6

  mailing-list, exploit

• openwall.com /lists/oss-security/2011/07/13/5

  mailing-list, exploit

• secunia.com /advisories/45184

  third-party-advisory, vendor-advisory

• securityreason.com /securityalert/8312

  third-party-advisory

• osvdb.org /73891

  vdb-entry

• ocert.org /advisories/ocert-2011-001.html
• exchange.xforce.ibmcloud.com /vulnerabilities/68565

  vdb-entry

• securityfocus.com /archive/1/518890/100/0/threaded

  mailing-list

• CVE List CVE-2011-2780
• NVD CVE-2011-2780

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.