CVE-2024-51998High· 8.6▾ Twilightchangedetection.io path traversal using file URI scheme without supplying hostname
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and ALLOW_FILE_URI false or not defined.
The check used for URL protocol, is_safe_url, allows file: as a URL scheme:
It later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with file://. The issue comes with the fact that the file URI scheme is not required to have double slashes.
A valid file URI must therefore begin with either
file:/path(no hostname),file:///path(empty hostname), orfile://hostname/path. — Wikipedia
file:/etc/passwd or a similar path for your operating system. Enable webdriver modechangedetection-io < 0.47.6Upgrade to a patched release:
changedetection-io 0.47.6Connected by shared product, vendor, weakness, or advisory.
CVE-2024-23329Low· 3.7changedetection.io API endpoint is not secured with API token
CVE-2024-32651Critical· 10.0changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
CVE-2026-27645Medium· 6.1changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
CVE-2026-29038Medium· 6.1changedetection.io has Reflected XSS in its RSS Tag Error Response
CVE-2026-29039Highchangedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
CVE-2026-33981HighChangedetection.io Discloses Environment Variables via jq env Builtin in Include Filters