Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-95273: changedetection.io allows remote file access via path traversal
CVE-2026-95273 · published 27 days ago
Summary
The changedetection.io web tool (versions up to 0.60.7) lets an attacker supply a crafted file name to a function that serves static files. This can cause the server to reveal or serve any file on its system, potentially exposing sensitive data. Update to the latest version or apply the vendor's patch to restrict file paths.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dgtlmoon | changedetection.io | 0.60.0 |
Original advisory text
dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the component visual_selector_data. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Distinct from CVE-2026-25527, which fixed a different parameter (group) in the same function. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-22Path Traversal
Timeline
Published22 Sep 2026
Updated19 Oct 2026
First seen22 Sep 2026
Track software like this
Free during beta