CVE-2026-95272: changedetection.io Path Traversal Vulnerability

CVE-2026-95272 Overview

CVE-2026-95272 is a path traversal vulnerability [CWE-22] in dgtlmoon changedetection.io through version 0.60.7. The flaw resides in the static_content function inside changedetectionio/flask_app.py, part of the Screenshot Handler component. An attacker can manipulate the filename argument to traverse directories and access files outside the intended path. The attack is remote, requires no authentication, and requires no user interaction, but exploitation is rated as high complexity. The vendor was notified early but did not respond. Public exploit details have been released.

Critical Impact
Unauthenticated remote attackers can read files outside the screenshot directory by manipulating the filename parameter, though exploitation is reported as difficult.

Affected Products

dgtlmoon changedetection.io versions up to and including 0.60.7
Component: Screenshot Handler (changedetectionio/flask_app.py)
Function: static_content

Discovery Timeline

2026-09-22 - CVE-2026-95272 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95272

Vulnerability Analysis

The vulnerability affects the static_content route handler in changedetectionio/flask_app.py. This handler serves screenshot artifacts generated by changedetection.io monitoring jobs. The filename argument passed to the handler is used to construct a file path without proper canonicalization or sanitization. Attackers can supply traversal sequences such as ../ in the filename parameter to escape the intended screenshot directory. Successful exploitation allows reading arbitrary files that the changedetection.io process can access on the host filesystem.

Because changedetection.io often runs inside containers or dedicated hosts, the reachable file scope typically includes application configuration, watch definitions, and any secrets stored on disk. The confidentiality impact is limited (VC:L), while integrity and availability are not affected.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The static_content function accepts a user-controlled filename value and joins it into a filesystem path without validating that the resulting path stays within the designated screenshot directory. Missing checks for directory-traversal sequences and absent path normalization allow the traversal to succeed.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the static_content endpoint over the network. The attacker supplies a filename value containing traversal sequences that resolve outside the screenshot directory. High complexity reflects preconditions such as knowledge of the target filesystem layout and the specific installation path used by changedetection.io. See the GitHub Path Traversal Overview and VulDB CVE-2026-95272 Details for public technical write-ups.

Detection Methods for CVE-2026-95272

Indicators of Compromise

HTTP requests to the changedetection.io static_content endpoint containing ../, ..%2f, %2e%2e/, or absolute path prefixes in the filename parameter.
Access log entries showing screenshot handler requests with filenames referencing sensitive paths such as /etc/passwd, application config files, or database files.
Unexpected outbound file reads from the changedetection.io process user against directories outside the screenshot storage location.

Detection Strategies

Deploy web application firewall (WAF) rules that block path traversal patterns in query strings and URL segments targeting changedetection.io endpoints.
Enable verbose HTTP request logging on the reverse proxy or Flask application and alert on filename values containing traversal metacharacters.
Correlate process-level file access telemetry with HTTP access logs to surface reads outside the expected screenshot directory.

Monitoring Recommendations

Monitor access logs for anomalous 200 responses on the screenshot route paired with atypical filename values.
Track file access by the changedetection.io service account for reads targeting configuration, credential, or key material files.
Alert on repeated malformed requests to screenshot handlers that may indicate reconnaissance for exploitable installations.

How to Mitigate CVE-2026-95272

Immediate Actions Required

Restrict network exposure of changedetection.io instances to trusted networks or behind authenticated reverse proxies until a fix is available.
Place a WAF or reverse proxy in front of the application to reject requests containing path traversal sequences in the filename parameter.
Run the changedetection.io process with a dedicated least-privilege user and confine it to a chroot, container, or filesystem namespace that limits reachable files.

Patch Information

At time of publication, no vendor patch is referenced in the CVE record. The vendor did not respond to disclosure attempts. Monitor the dgtlmoon changedetection.io repository and the VulDB Vulnerability Report #408340 for updates on official fixes and revised versions beyond 0.60.7.

Workarounds

Block or rewrite HTTP requests to the screenshot handler that contain .., encoded traversal sequences, or absolute path characters.
Enforce authentication on the changedetection.io front end and require VPN or SSO access for all users.
Store sensitive files outside the filesystem tree reachable by the changedetection.io process, and restrict directory permissions on configuration and credential files.

bash

# Example NGINX reverse-proxy rule to block traversal patterns
# targeting the changedetection.io screenshot handler
location ~* /static_content {
    if ($arg_filename ~* "(\.\./|\.\.\\|%2e%2e|/etc/|/root/)") {
        return 403;
    }
    proxy_pass http://changedetection_upstream;
}