CVE-2026-95273 in changedetection.io
Summary
by MITRE • 09/22/2026
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the component visual_selector_data. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Distinct from CVE-2026-25527, which fixed a different parameter (group) in the same function. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in dgtlmoon changedetection.io versions up to 0.60.7 represents a critical security flaw within the application's static content serving mechanism, specifically located in the flask_app.py file under the visual_selector_data component. This issue manifests as a path traversal vulnerability, allowing an attacker to manipulate the filename argument passed to the static_content function. By crafting specific input sequences that exploit insufficient validation of user-supplied data, an adversary can bypass intended directory restrictions and access files outside the designated web root or application directories. This type of flaw is classically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which highlights the failure to properly sanitize input before using it in file system operations. The presence of this vulnerability indicates that the framework did not adequately normalize or validate paths containing directory traversal sequences such as dot-dot-slash patterns, enabling unauthorized read access to sensitive configuration files, source code, or other critical resources stored on the server's filesystem.
The operational impact of this path traversal is severe due to its remote exploitability and public disclosure status. Since the vulnerability can be triggered remotely without authentication in many configurations, it significantly expands the attack surface available to malicious actors who have discovered the publicly disclosed proof-of-concept code. An attacker leveraging this flaw could potentially exfiltrate sensitive data that was not intended for public access, leading to confidentiality breaches of intellectual property or user information depending on what files are accessible through the traversal path. Furthermore, if combined with other vulnerabilities such as arbitrary file upload or execution flaws, this path traversal could serve as a stepping stone for more complex attacks including remote code execution. The fact that distinct parameters like group were addressed in CVE-2026-25527 while filename remained vulnerable suggests an incomplete remediation effort where only specific input vectors were sanitized, leaving other entry points within the same function exposed to similar exploitation techniques.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1083: File and Directory Discovery, as it allows attackers to enumerate and access files on the target system. The public availability of exploit code lowers the barrier to entry for less sophisticated adversaries, increasing the likelihood of automated scanning and exploitation attempts against instances running affected versions. The vendor's lack of response despite early notification exacerbates the risk landscape, leaving users without official patches or workarounds from the primary maintainer. This situation underscores the importance of proactive vulnerability management and the necessity for organizations to monitor not just critical severity ratings but also the availability of public exploits when assessing risk.
Mitigation strategies must focus on immediate isolation and input validation since vendor remediation is unavailable. Administrators should restrict network access to changedetection.io instances by placing them behind a reverse proxy that enforces strict URL filtering rules, blocking any requests containing path traversal sequences such as ../ or ..%2f in the filename parameter. Additionally, implementing Web Application Firewall (WAF) signatures capable of detecting and dropping malicious file path manipulation attempts can provide an additional layer of defense. It is also advisable to review server configurations to ensure that the web server itself enforces chroot jails or containerized environments with minimal filesystem permissions, limiting the damage even if traversal occurs. Organizations should prioritize upgrading to a patched version as soon as one becomes available and consider alternative solutions if the vendor remains unresponsive to security disclosures, ensuring long-term resilience against known exploitation techniques associated with CWE-22 vulnerabilities.