Unrated severityNVD Advisory· Published Feb 19, 2026· Updated Feb 19, 2026
changedetection.io vulnerable to unauthenticated static path traversal
CVE-2026-25527
Description
changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the /static// route accepts group="..", which causes send_from_directory("static/..", filename) to execute. This moves the base directory up to /app/changedetectionio, enabling unauthenticated local file read of application source files (e.g., flask_app.py). Version 0.53.2 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <0.53.2
- Range: < 0.53.2
Patches
Vulnerability mechanics
References
2- github.com/dgtlmoon/changedetection.io/commit/9d38b4517364831889b5b0d7b3465fd060403fd4mitrex_refsource_MISC
- github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-9jj8-v89v-xjvwmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.