{"id":"CVE-2024-51483","aliases":["GHSA-cwgg-57xj-g77r","PYSEC-2026-1240"],"title":"changedetection.io Path Traversal","summary":"changedetection.io Path Traversal","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","vendor":"changedetection-io","product":"changedetection-io","ecosystem":"pip","affected":["changedetection-io < 0.47.5"],"patched":["changedetection-io 0.47.5"],"published":"2024-11-01","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cwgg-57xj-g77r","references":[{"url":"https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-cwgg-57xj-g77r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51483"},{"url":"https://github.com/dgtlmoon/changedetection.io"},{"url":"https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19"},{"url":"https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35"},{"url":"https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf"}],"tags":["osv","pip","exploit-available"],"epss":0.02274,"epssPercentile":0.82353,"ingestedAt":"2026-07-08T18:25:48.598Z","exploits":{"nuclei":["CVE-2024-51483"],"checkedAt":"2026-09-24T07:52:51.828Z"},"exploitAvailable":true,"slug":"CVE-2024-51483","body":"## Overview\n\n### Summary\nWhen a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked\n\n### Details\nThe root cause is the payload source:file:///etc/passwdpasses the regex [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19) and also passes the check [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35) where a traditional file:///etc/passwd would get blocked\n\n### PoC\n[CL-ChangeDetection.io Path Travsersal-311024-181039.pdf](https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf)\n\n\n\n### Impact\nIt depends on where the webdriver is deployed but generally this is a high impact vulnerability \n\n\n## Affected packages\n\n- `changedetection-io < 0.47.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `changedetection-io 0.47.5`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[{"seq":4738,"id":"CVE-2024-51483","ts":1788887203101,"field":"exploit_available","old":"false","new":"true"},{"seq":3621,"id":"CVE-2024-51483","ts":1788886319260,"field":"exploit_available","old":"true","new":"false"},{"seq":2475,"id":"CVE-2024-51483","ts":1788882987808,"field":"exploit_available","old":"false","new":"true"},{"seq":1504,"id":"CVE-2024-51483","ts":1788882401365,"field":"exploit_available","old":"true","new":"false"},{"seq":618,"id":"CVE-2024-51483","ts":1788881838022,"field":"exploit_available","old":"false","new":"true"}]}