changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/dgtlmoon/changedetection.io/commit/9d38b4517364831889b5b0d7b3465fd060403fd4 | Patch |
| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-9jj8-v89v-xjvw | Exploit Vendor Advisory |
Configurations
History
19 Feb 2026, 19:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/dgtlmoon/changedetection.io/commit/9d38b4517364831889b5b0d7b3465fd060403fd4 - Patch | |
| References | () https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-9jj8-v89v-xjvw - Exploit, Vendor Advisory | |
| First Time |
Webtechnologies changedetection
Webtechnologies |
|
| CPE | cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:* |
19 Feb 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-19 15:16
Updated : 2026-02-19 19:54
NVD link : CVE-2026-25527
Mitre link : CVE-2026-25527
CVE.ORG link : CVE-2026-25527
JSON object : View
Products Affected
webtechnologies
- changedetection
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')