CVE-2026-25527: Changedetection Path Traversal Vulnerability

CVE-2026-25527 Overview

CVE-2026-25527 is a path traversal vulnerability in changedetection.io, a free open source web page change detection tool. In versions prior to 0.53.2, the /static/<group>/<filename> route accepts group="..", which causes send_from_directory("static/..", filename) to execute. This moves the base directory up to /app/changedetectionio, enabling unauthenticated local file read of application source files (e.g., flask_app.py).

Critical Impact

Unauthenticated attackers can read sensitive application source files remotely, potentially exposing configuration secrets, API keys, and application logic.

Affected Products

• webtechnologies changedetection (versions prior to 0.53.2)

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-25527 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25527

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the Flask application's static content serving mechanism. The vulnerable endpoint /static/<group>/<filename> fails to properly sanitize the group parameter, allowing directory traversal sequences such as .. to escape the intended static file directory. When an attacker supplies .. as the group value, the send_from_directory() function resolves to /app/changedetectionio instead of the expected /app/changedetectionio/static directory, granting read access to application source files.

The vulnerability is particularly concerning because it requires no authentication, allowing any remote attacker with network access to the application to read sensitive files. This could expose application secrets, database credentials, API keys, and other sensitive configuration data embedded in the source code.

Root Cause

The root cause is insufficient input validation on the group parameter in the static content route handler. The original regex pattern r'[^\w.-]+' allowed the . and - characters, which meant that the directory traversal sequence .. would pass through the filter intact. This permitted attackers to traverse out of the static directory and access files in parent directories.

Attack Vector

The attack can be executed via a simple HTTP GET request to the vulnerable endpoint. An attacker crafts a request to /static/../<filename> where <filename> is a target file such as flask_app.py. The server processes this request, traverses up one directory level from the static folder, and returns the contents of the requested file without requiring any authentication.

# Vulnerable code pattern (before fix):
def static_content(group, filename):
    from flask import make_response
    import re
    group = re.sub(r'[^\w.-]+', '', group.lower())
    filename = re.sub(r'[^\w.-]+', '', filename.lower())
    # The '..' in group passes through, allowing traversal

Source: GitHub Commit Details

Detection Methods for CVE-2026-25527

Indicators of Compromise

• HTTP requests to /static/../ paths in web server access logs
• Requests attempting to access application source files like flask_app.py, config.py, or similar
• Multiple sequential requests probing different file paths from the same source IP
• Unusual 200 OK responses for static content requests with traversal patterns

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal patterns containing .. sequences
• Implement log analysis rules to detect requests to the /static/ endpoint containing double-dot sequences
• Review application logs for successful file access outside the static directory
• Deploy intrusion detection signatures for HTTP requests with directory traversal indicators

Monitoring Recommendations

• Enable detailed access logging for the changedetection.io application
• Configure alerting for requests matching path traversal patterns in the static endpoint
• Monitor for spikes in 404 errors that may indicate reconnaissance activity
• Review outbound data transfer volumes for potential data exfiltration

How to Mitigate CVE-2026-25527

Immediate Actions Required

• Upgrade changedetection.io to version 0.53.2 or later immediately
• Review web server access logs for signs of prior exploitation
• Rotate any secrets or credentials that may have been exposed in source files
• Implement network-level access controls to restrict who can reach the application

Patch Information

The vulnerability has been fixed in changedetection.io version 0.53.2. The patch implements stricter input sanitization that only allows alphanumeric characters and underscores, effectively blocking directory traversal sequences. Additionally, the fix includes validation to reject empty strings that could result from sanitization.

The security fix is available in commit 9d38b4517364831889b5b0d7b3465fd060403fd4. For detailed information, refer to the GitHub Security Advisory GHSA-9jj8-v89v-xjvw.

Workarounds

• Deploy a web application firewall (WAF) rule to block requests containing .. in the URL path
• Use a reverse proxy to filter and sanitize requests before they reach the application
• Restrict network access to the changedetection.io instance to trusted IP addresses only
• If upgrading is not immediately possible, consider temporarily disabling the application until the patch can be applied

# Patched code - Security fix for CVE-2026-25527
def static_content(group, filename):
    from flask import make_response
    import re
    # Strict sanitization: only allow a-z, 0-9, and underscore (blocks .. and other traversal)
    group = re.sub(r'[^a-z0-9_]+', '', group.lower())
    filename = re.sub(r'[^a-z0-9_]+', '', filename.lower())

    # Additional safety: reject if sanitization resulted in empty strings
    if not group or not filename:
        abort(404)

    if group == 'screenshot':
        # Could be sensitive, follow password requirements

Source: GitHub Commit Details