CVE-2024-51483 changedetection.io Path Traversal vulnerability
Attackers can read local system files via WebDriver file:// URIs in changedetection.io, requiring the WebDriver feature to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-51483?
CVE-2024-51483 is a medium-severity path traversal vulnerability in dgtlmoon changedetection.io, published on 1 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
Weakness: CWE-22
Which versions are affected by CVE-2024-51483?
3 open source packages ship an affected version, including changedetection.io and changedetection-io.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.47.5 |
changedetection-io PyPI | All versions | 0.47.5 |
changedetection-io PyPI | All versions | 0.47.5 |
How do I fix CVE-2024-51483?
Upgrade changedetection.io to 0.47.5 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-51483 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-51483 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-cwgg-57xj-g77r, PYSEC-2026-1240.