Description

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the component visual_selector_data. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Distinct from CVE-2026-25527, which fixed a different parameter (group) in the same function. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T13:17:13.123Z",
  "pubdate": "2026-09-22T13:17:13.123Z",
  "executiveSummary": "A path traversal vulnerability exists in the visual_selector_data component of dgtlmoon changedetection.io, affecting versions up to 0.60.7. The vulnerability resides within the static_content function of changedetectionio/flask_app.py and arises from improper neutralization of special elements used in the filename argument.\nThis flaw allows a remote, unauthenticated attacker to bypass directory restrictions and access arbitrary files on the underlying filesystem where the application is hosted. The security risk is classified as high, as successful exploitation enables sensitive information disclosure, potentially exposing configuration files, environment variables, or other restricted system data. The vulnerability is distinct from CVE-2026-25527, which addressed a similar issue in the group parameter within the same function. Exploitation is facilitated by the public availability of proof-of-concept material, increasing the likelihood of malicious utilization.",
  "technicalDetails": "The vulnerability originates from the improper validation and sanitization of the filename argument passed to the static_content function within the visual_selector_data component in changedetectionio/flask_app.py. In affected versions (up to 0.60.7), the application fails to adequately constrain the user-supplied filename input to the intended directory path.\nThe technical root cause is an insecure file retrieval mechanism that concatenates the user-provided filename directly to a base directory path without sufficiently validating against directory traversal sequences (e.g., '../'). By injecting traversal sequences, an attacker can manipulate the path resolution process to escape the designated static content directory and traverse the filesystem hierarchy.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP request to the application, targeting the endpoint mapped to the static_content function. The request includes a manipulated filename argument containing sequences such as '../../'. Because the underlying Flask application does not sanitize these inputs, the file system API is instructed to open a file path outside the intended scope.\nThe vulnerability is remotely exploitable and does not require prior authentication or elevated privileges. Once the traversal is successful, the application serves the content of the requested file directly to the attacker's response. This leads to arbitrary file reading, which can be leveraged to extract sensitive system information, application secrets, or database credentials stored within the local environment.\nThis vulnerability is distinct from the previously identified CVE-2026-25527. While both vulnerabilities are located in the static_content function of changedetectionio/flask_app.py, they involve different vulnerable parameters. While CVE-2026-25527 targeted the group parameter, the current vulnerability specifically impacts the filename parameter. The lack of a comprehensive sanitization routine across all function arguments in the component suggests an underlying flaw in the input handling architecture of the visual_selector_data component."
}