CVE-2026-95273
Received Received - Intake

Path Traversal in changedetection.io

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulDB

Description
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the component visual_selector_data. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Distinct from CVE-2026-25527, which fixed a different parameter (group) in the same function. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95273
EUVD
EUVD-2026-84370

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dgtlmoon changedetection.io 0.60.7
dgtlmoon changedetection.io to 0.55.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-95273 is a path traversal vulnerability in changedetection.io versions up to 0.60.7. It exists in the static_content function of changedetectionio/flask_app.py when the group parameter is set to visual_selector_data. The filename parameter is not properly sanitized, allowing attackers to use traversal sequences like .. to access files outside the intended directory. This can lead to unauthorized access to system files or other users' data.

Detection Guidance

Check for changedetection.io versions 0.55.8 or earlier. Inspect the static_content() handler in changedetectionio/flask_app.py for unsanitized filename parameters. Look for unusual file access patterns or traversal sequences in logs.

Impact Analysis

This vulnerability could allow remote attackers to read sensitive files on the server where changedetection.io is running. If exploited, it may lead to exposure of configuration files, user data, or other confidential information. The impact depends on the server's file system permissions and the data stored on it.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit may violate these regulations, potentially leading to legal consequences and fines.

Mitigation Strategies

Upgrade changedetection.io to a patched version. Validate the filename parameter to ensure it matches a watch UUID. Add path normalization and base directory validation. Implement watch ownership checks for all file access branches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart