CVE-2024-56509High· 8.6▾ Twilightchangedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal
changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal
▾ Twilight zone — High severity, or a signal on a lesser flaw
Depth score47/ 100 · Moderate
impact 47.3 · likelihood 0.1 · exploitation 0
Proof of concept
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Published
Dec 27, 2024
Updated
Sep 10, 2026
CVSS
8.6
Vendor
changedetection-io
Product
changedetection-io
CWE
—
Depth score
47 · Moderate
EPSS
0.70% · p52
Platforms
—
Source
OSV
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS history
Exploit-prediction probability, daily snapshots since Jul 8.
Timeline
Disclosure to exploitation, from the record and what we observed since indexing it.
- Published
Disclosed via OSV
- EPSS first tracked
0.7%
- EPSS peak
0.7% → 0.7%
- Record revised
Last analysed / modified upstream
Affected
- changedetection-io < 0.48.05
Patched in
- changedetection-io 0.48.05
Full technical detail▾
Overview
Summary
Improper input validation in the application can allow attackers to perform local file read (LFR) or path traversal attacks. These vulnerabilities occur when user input is used to construct file paths without adequate sanitization or validation. For example, using file:../../../etc/passwd or file: ///etc/passwd can bypass weak validations and allow unauthorized access to sensitive files. Even though this has been addressed in previous patch, it is still insufficient.
Details
The check in this line of code is insufficient.
if re.search(r'^file:/', url.strip(), re.IGNORECASE):
The attacker can still bypass this by using:
-file:../../../../etc/passwd
-file: ///etc/passwd (with space before /)
PoC
- Open up a changedetection.io instance with a webdriver configured.
- Create a new watch with
file:../../../../etc/passwd. - Check the watch preview.
- The contents of
/etc/passwdshould pop out.
Screenshots
Affected packages
changedetection-io < 0.48.05
Remediation
Upgrade to a patched release:
changedetection-io 0.48.05
References
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-j5vv-6wjg-cfr8
- https://nvd.nist.gov/vuln/detail/CVE-2024-56509
- https://github.com/dgtlmoon/changedetection.io/commit/4419bc0e61d0b03c588bd573a3602bbcfd953671
- https://github.com/dgtlmoon/changedetection.io/commit/f7e9846c9b40a229813d19cdb66bf60fbe5e6a2a
- https://github.com/dgtlmoon/changedetection.io
Related vulnerabilities
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-23329Low· 3.7changedetection.io API endpoint is not secured with API token
same productshared advisory#osvCVE-2024-32651Critical· 10.0changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
same productshared advisory#osvCVE-2026-27645Medium· 6.1changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
same productshared advisory#osvCVE-2026-29038Medium· 6.1changedetection.io has Reflected XSS in its RSS Tag Error Response
same productshared advisory#osvCVE-2026-29039Highchangedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
same productshared advisory#osvCVE-2026-33981HighChangedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
same productshared advisory#osv
#osv#pip