---
id: CVE-2024-51483
aliases:
  - GHSA-cwgg-57xj-g77r
  - PYSEC-2026-1240
title: changedetection.io Path Traversal
summary: changedetection.io Path Traversal
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
vendor: changedetection-io
product: changedetection-io
ecosystem: pip
affected:
  - changedetection-io < 0.47.5
patched:
  - changedetection-io 0.47.5
published: '2024-11-01'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-cwgg-57xj-g77r'
references:
  - url: >-
      https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-cwgg-57xj-g77r
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-51483'
  - url: 'https://github.com/dgtlmoon/changedetection.io'
  - url: >-
      https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19
  - url: >-
      https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35
  - url: >-
      https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf
tags:
  - osv
  - pip
  - exploit-available
epss: 0.02274
epssPercentile: 0.82353
ingestedAt: '2026-07-08T18:25:48.598Z'
exploits:
  nuclei:
    - CVE-2024-51483
  checkedAt: '2026-09-24T07:52:51.828Z'
exploitAvailable: true
---

## Overview

### Summary
When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked

### Details
The root cause is the payload source:file:///etc/passwdpasses the regex [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19) and also passes the check [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35) where a traditional file:///etc/passwd would get blocked

### PoC
[CL-ChangeDetection.io Path Travsersal-311024-181039.pdf](https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf)



### Impact
It depends on where the webdriver is deployed but generally this is a high impact vulnerability 


## Affected packages

- `changedetection-io < 0.47.5`

## Remediation

Upgrade to a patched release:

- `changedetection-io 0.47.5`