CVE-2011-2745: Chyrp

Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days.

upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/.

Affected products

• Chyrp Chyrp: up to and including 2.0

Published 2011-07-27. Last modified 2026-06-16.