CVE-2026-95273: dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function staticcontent of the file changedetectionio/flaskapp.py of the component visualselectordata. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Distinct from CVE-2026-25527, which fixed a different parameter (group) in the same function. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects dgtlmoon changedetection.io versions up to 0.60.7. The affected code is the visual_selector_data component's static_content function in changedetectionio/flask_app.py.
What access does an attacker need?
The attack can be launched remotely and requires low privileges. No user interaction is required.
What is the impact of successful exploitation?
Successful manipulation of the filename argument can enable path traversal. The supplied severity vector indicates low confidentiality impact, with no integrity or availability impact listed.
Is this the same issue as CVE-2026-25527?
No. CVE-2026-25527 addressed a different parameter, group, in the same function; this issue concerns the filename argument.
Is exploit information available?
Yes. The exploit has been publicly disclosed and may be used.