Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.9
CVE-2026-95272: changedetection.io allows attackers to read any file
CVE-2026-95272 · published 27 days ago
Summary
The screenshot feature in changedetection.io versions up to 0.60.7 accepts a file name that can be tricked into accessing files outside its own folder. An attacker could use this to view sensitive files on the server from a remote location. Update to a patched version or apply the vendor’s recommended configuration change to block the unsafe file paths.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dgtlmoon | changedetection.io | 0.60.0 |
Original advisory text
dgtlmoon changedetection.io Screenshot flask_app.py static_content path traversal
A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the file changedetectionio/flask_app.py of the component Screenshot Handler. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.9
Low
Type
CWE-22Path Traversal
Timeline
Published22 Sep 2026
Updated19 Oct 2026
First seen22 Sep 2026
Track software like this
Free during beta