{"id":"CVE-2024-51998","aliases":["GHSA-6jrf-rcjf-245r","PYSEC-2026-1239"],"title":"changedetection.io path traversal using file URI scheme without supplying hostname","summary":"changedetection.io path traversal using file URI scheme without supplying hostname","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","vendor":"changedetection-io","product":"changedetection-io","ecosystem":"pip","affected":["changedetection-io < 0.47.6"],"patched":["changedetection-io 0.47.6"],"published":"2024-11-07","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6jrf-rcjf-245r","references":[{"url":"https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6jrf-rcjf-245r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51998"},{"url":"https://github.com/dgtlmoon/changedetection.io/commit/49bc982c697169c98b79698889fb9d26f6b3317f"},{"url":"https://github.com/dgtlmoon/changedetection.io"},{"url":"https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13"},{"url":"https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/processors/__init__.py#L37-L41"},{"url":"https://github.com/dgtlmoon/changedetection.io/releases/tag/0.47.06"}],"tags":["osv","pip"],"epss":0.00688,"epssPercentile":0.50901,"ingestedAt":"2026-07-08T18:25:46.488Z","slug":"CVE-2024-51998","body":"## Overview\n\n### Summary\n\nThe validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and `ALLOW_FILE_URI` false or not defined.\n\n### Details\n\nThe check used for URL protocol, `is_safe_url`, allows `file:` as a URL scheme:\n\nhttps://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13\n\nIt later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with `file://`. The issue comes with the fact that the file URI scheme is not required to have double slashes.\n\n> A valid file URI must therefore begin with either `file:/path` (no hostname), `file:///path` (empty hostname), or `file://hostname/path`.\n> — [Wikipedia](https://en.wikipedia.org/wiki/File_URI_scheme#Number_of_slash_characters)\n\nhttps://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/processors/__init__.py#L37-L41\n\n### PoC\n\n1. Open up a changedetection.io instance with a webdriver configured\n2. Create a new watch: `file:/etc/passwd` or a similar path for your operating system. Enable webdriver mode\n3. Wait for it to be checked\n4. Open preview\n5. Notice contents of the file\n\n\n## Affected packages\n\n- `changedetection-io < 0.47.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `changedetection-io 0.47.6`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}