CVE-2026-95273: changedetection.io Path Traversal Vulnerability

CVE-2026-95273 Overview

CVE-2026-95273 is a path traversal vulnerability [CWE-22] affecting dgtlmoon changedetection.io versions up to and including 0.60.7. The flaw resides in the static_content function within changedetectionio/flask_app.py, part of the visual_selector_data component. An authenticated remote attacker can manipulate the filename argument to traverse outside the intended directory and access files on the host system.

This issue is distinct from CVE-2026-25527, which addressed a different parameter (group) in the same function. According to the disclosure, the vendor was contacted but did not respond, and a public proof-of-concept has been released.

Critical Impact
Authenticated remote attackers can read arbitrary files accessible to the changedetection.io process by supplying crafted filename values to the visual selector endpoint.

Affected Products

dgtlmoon changedetection.io versions up to 0.60.7
Component: visual_selector_data
Affected function: static_content in changedetectionio/flask_app.py

Discovery Timeline

2026-09-22 - CVE-2026-95273 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95273

Vulnerability Analysis

The vulnerability exists in the static_content handler that serves data for the visual selector feature of changedetection.io. The handler consumes a filename request argument and uses it to locate a file on disk without sufficiently constraining the path to the intended base directory. An attacker with a valid low-privilege session can submit traversal sequences such as ../ in the filename parameter to read files outside the visual selector data directory.

Because the attack is remote and requires only low privileges with no user interaction, any account able to interact with the visual selector interface can invoke the flaw. The impact is limited to confidentiality of files readable by the application process; integrity and availability are not directly affected.

Root Cause

The root cause is missing or insufficient path canonicalization and validation of the filename argument before it is used in file system operations. The fix applied for CVE-2026-25527 addressed the group parameter but did not extend the same normalization to filename, leaving this second sink exploitable.

Attack Vector

An attacker sends an HTTP request to the visual selector endpoint that serves static content, supplying a filename value containing directory traversal sequences. The application resolves the path relative to its working directory and returns the file contents. See the GitHub PoC Repository and VulDB CVE-2026-95273 for reference material.

No verified code examples are available. Refer to the public proof-of-concept for exact request structure.

Detection Methods for CVE-2026-95273

Indicators of Compromise

HTTP requests to the changedetection.io visual selector endpoint containing ../, ..%2f, or encoded traversal sequences in the filename query parameter.
Application responses returning content types or file sizes inconsistent with expected visual selector JSON or image payloads.
Access log entries showing repeated filename variations from a single authenticated session enumerating host paths.

Detection Strategies

Inspect web server and reverse proxy logs for requests to the static_content route with suspicious filename values, including URL-encoded traversal patterns.
Deploy a web application firewall (WAF) rule that blocks or alerts on path traversal payloads targeting changedetection.io endpoints.
Correlate authentication events with anomalous file-access patterns from low-privileged accounts.

Monitoring Recommendations

Enable verbose access logging on the reverse proxy fronting changedetection.io and forward logs to a centralized analytics platform.
Monitor filesystem read events on the host running changedetection.io for reads of sensitive files (/etc/passwd, configuration files, secrets) by the application user.
Alert on outbound data volume spikes from the changedetection.io host that may indicate bulk file exfiltration.

How to Mitigate CVE-2026-95273

Immediate Actions Required

Restrict network access to the changedetection.io interface using firewall rules or reverse proxy allow-lists until a patched release is available.
Rotate any credentials, API tokens, or secrets stored on the host running changedetection.io that may have been readable by the application process.
Audit user accounts and disable unused or low-trust accounts that can access the visual selector.

Patch Information

At the time of publication, no vendor patch is referenced in the CVE record. The vendor was contacted but did not respond, per the disclosure notes on VulDB CVE-2026-95273. Monitor the upstream project for releases after version 0.60.7 and apply updates when available.

Workarounds

Place changedetection.io behind a reverse proxy that normalizes URLs and rejects requests whose filename parameter contains traversal sequences or absolute paths.
Run the changedetection.io process under a dedicated, low-privileged user account with filesystem access limited to required directories only.
Deploy the application inside a container or chroot with a minimal read-only filesystem to reduce the set of files exposed by a successful traversal.

bash

# Example nginx snippet to block traversal payloads on the visual selector endpoint
location /static_content {
    if ($arg_filename ~* "(\.\./|\.\.%2f|%2e%2e/|^/)") {
        return 400;
    }
    proxy_pass http://changedetection_upstream;
}