CVE-2026-25527: dgtlmoon changedetection.io path traversal in static content route

Executive brief

changedetection.io, a tool used for monitoring website changes, is vulnerable to an unauthorized file access flaw. An attacker can exploit this to read the application's internal source code files without needing a password. This could allow unauthorized parties to study the application's logic to find further weaknesses or sensitive configuration details.

Technical details

A path traversal vulnerability exists in the `/static/<group>/<filename>` route of changedetection.io due to insufficient input sanitization in `flask_app.py`. The `group` parameter is processed using a regular expression that allows dots, enabling an attacker to use `..` to traverse up from the intended `static/` directory. By setting `group` to `..`, the `send_from_directory` function executes relative to the application root, allowing unauthenticated remote attackers to read internal Python source files (e.g., `flask_app.py`). The exploit is limited to the application package directory as the `filename` parameter rejects slashes, preventing access to arbitrary system files like `/etc/passwd`. This issue is resolved in version 0.53.2.

Affected products

• dgtlmoon changedetection.io < 0.53.2

Timeline

• 2026-02-16: disclosed: Initial disclosure by reporter
• 2026-02-19: advisory: NVD publication date
• 2026-07-20: patched: GitHub Advisory published and reviewed

References

• https://api.github.com/users/minnggyuu
• https://github.com/minnggyuu
• https://api.github.com/users/minnggyuu/gists%7B/gist_id%7D
• https://api.github.com/users/minnggyuu/repos
• https://avatars.githubusercontent.com/u/154591990?v=4
• https://api.github.com/users/minnggyuu/events%7B/privacy%7D