Description

A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the file changedetectionio/flask_app.py of the component Screenshot Handler. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-22T13:17:12.950Z",
  "pubdate": "2026-09-22T13:17:12.950Z",
  "executiveSummary": "A path traversal vulnerability exists in the screenshot handler component of dgtlmoon changedetection.io, affecting versions up to 0.60.7.\nThe vulnerability resides within the static_content function of changedetectionio/flask_app.py and allows an attacker to manipulate the filename argument to access unauthorized files on the underlying filesystem.\nThis is a remotely exploitable vulnerability, although it is characterized by high complexity and difficult exploitability.\nThe vulnerability is currently public, and the vendor has not responded to disclosure attempts, necessitating proactive defensive measures.\nSuccessful exploitation could lead to unauthorized information disclosure, depending on the permissions of the service process.\nThe risk implication is significant as it provides a mechanism for directory traversal outside the intended web root or application directory structure, potentially exposing sensitive configuration files or system data.",
  "technicalDetails": "The vulnerability is a classic path traversal flaw located in the screenshot handler functionality of changedetection.io. Specifically, the static_content function within the changedetectionio/flask_app.py file fails to adequately sanitize the user-supplied filename parameter before utilizing it to construct a filesystem path for file access.\nRoot cause analysis indicates that the application does not properly validate or restrict the input provided to the filename argument. By injecting path traversal sequences (such as ../) into this parameter, an attacker can bypass intended directory restrictions and traverse the filesystem to access files outside the designated static content directory.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP request to the vulnerable endpoint, manipulating the filename argument. The application takes this unsanitized input and concatenates it with a base directory path. Due to the lack of path normalization or filtering, the underlying operating system resolves the traversal sequences, causing the application to read and return the content of the unintended file to the attacker.\nThis vulnerability is remotely exploitable, meaning an attacker does not require local access to the server. However, it is classified as having high complexity and being difficult to exploit. This implies that successful exploitation may require specific conditions, such as knowledge of the server's directory structure, specific OS-level configurations, or the ability to bypass additional application-level filtering if present.\nAs the component is a part of a Flask-based application, the exploit behavior relies on the underlying Werkzeug/Flask handling of file paths. If the service is running with elevated privileges, the attacker could potentially access highly sensitive system files. The impact is primarily categorized as unauthorized information disclosure, as the ability to read arbitrary files can lead to the exposure of credentials, environment variables, or other sensitive application data, which may facilitate further compromise of the system."
}