CVE-2026-95272
Received Received - Intake

Path Traversal in ChangeDetection.io Screenshot Handler

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulDB

Description
A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the file changedetectionio/flask_app.py of the component Screenshot Handler. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95272
EUVD
EUVD-2026-84365

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dgtlmoon changedetection.io to 0.60.7 (inc)
dgtlmoon changedetection.io to 0.55.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-95272 is a path traversal vulnerability in changedetection.io versions up to 0.60.7. It occurs in the static_content function of flask_app.py where the filename parameter is used to construct a directory path without proper validation. Attackers can manipulate this parameter to access files outside the intended directory, including screenshots or system files.

Detection Guidance

Check if your changedetection.io instance is running a vulnerable version (0.55.8 or earlier). Inspect logs for unusual file access patterns or requests containing traversal sequences like .. or ..\. Use network monitoring tools to detect requests to the static_content endpoint with suspicious filename parameters.

Impact Analysis

This vulnerability allows remote attackers to access sensitive files outside the intended scope, such as screenshots from other watches or system files like /etc/passwd. The impact depends on the application's configuration, as authentication may not always be enforced for this endpoint.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized access to sensitive files, including screenshots or system files, due to path traversal. Unauthorized access to personal or health data violates confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade to a patched version of changedetection.io if available. If not, apply input validation to the filename parameter in flask_app.py, ensuring it only allows safe characters. Restrict access to the static_content endpoint via authentication and network policies. Monitor for any signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart