CVE-2026-25527 changedetection.io vulnerable to unauthenticated static path traversal
Unauthenticated attackers can read local application source files via path traversal in the static route, exposing sensitive code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25527?
CVE-2026-25527 is a medium-severity path traversal vulnerability in dgtlmoon changedetection.io, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-25527?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.53.2 |
changedetection-io PyPI | All versions | 0.53.2 |
changedetection-io PyPI | All versions | 0.53.2 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2026-25527?
Upgrade changedetection.io to 0.53.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25527 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25527 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Sources
Also known as GHSA-9jj8-v89v-xjvw, PYSEC-2026-2124.