changedetection.io Path Traversal vulnerability
Priority HIGH 70CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02293 83rd percentileScored 2026-11-07
Fix Fixed changedetection.io (dgtlmoon): 0.47.5changedetection.io (PyPI): 0.47.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dgtlmoon | changedetection.io | before 0.47.5 | 0.47.5 | Patch available | CNA |
| — | changedetection.io (PyPI) | before 0.47.5 | 0.47.5 | Patch available | GHSA-cwgg-57xj-g77r |
- changedetection.io Vendordgtlmoon Affected before 0.47.5 Fixed in 0.47.5 Patch available CNA
- changedetection.io (PyPI) Vendor— Affected before 0.47.5 Fixed in 0.47.5 Patch available GHSA-cwgg-57xj-g77r
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:changedetection:changedetection:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | Changedetection |
- cpe:2.3:a:changedetection:changedetection:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Changedetection
Remediation
- Fix · CNA changedetection.io (dgtlmoon) Fixed in 0.47.5
- Fix · GHSA-cwgg-57xj-g77r changedetection.io (PyPI) Fixed in 0.47.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-51483
- 2026-10-03 Alias added: GHSA-cwgg-57xj-g77r
References
Other 5
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-cwgg-57xj-g77r
- https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19
- https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35
- https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf
- https://github.com/dgtlmoon/changedetection.io
More dgtlmoon vulnerabilities
- TI-2024-21533 Server Side Template Injection in Jinja2 allows Remote Command Execution CVSS 3.1CRITICAL 10.0
- TI-2026-27619 changedetection.io has an Authentication Bypass via Decorator Ordering CVSS 3.1CRITICAL 9.8
- TI-2026-23210 changedetection.io: Zip Slip vulnerability in the backup restore functionality CVSS 4.0HIGH 8.8
- TI-2026-62554 changedetection.io through 0.60.6 SSRF via browser-step Goto URL CVSS 4.0HIGH 8.7
- TI-2026-22073 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs CVSS 3.1HIGH 8.6
- TI-2024-37396 changedetection.io has Improper Input Validation Leading to LFR/Path Traversal CVSS 3.1HIGH 8.6
Sources
- CVE-2024-51483 · CVE Program
- CVE-2024-51483 · NVD
- FIRST EPSS
- GHSA-cwgg-57xj-g77r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences