---
id: CVE-2026-25527
aliases:
  - PYSEC-2026-2124
  - GHSA-9jj8-v89v-xjvw
title: >-
  changedetection.io is a free open source web page change detection tool. In
  versions prior to 0.53.2, the `/static/<group>/<filename>` ro…
summary: >-
  changedetection.io is a free open source web page change detection tool. In
  versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts
  `group=".."`, which causes `send_from_directory("static/..", filename)` to
  execute. This…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: changedetection-io
product: changedetection-io
ecosystem: pip
affected:
  - changedetection-io < 0.53.2
patched:
  - changedetection-io 0.53.2
published: '2026-02-19'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-2124'
references:
  - url: >-
      https://github.com/dgtlmoon/changedetection.io/commit/9d38b4517364831889b5b0d7b3465fd060403fd4
  - url: >-
      https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-9jj8-v89v-xjvw
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00894
epssPercentile: 0.57754
ingestedAt: '2026-07-13T18:58:07.429Z'
exploits:
  nuclei:
    - CVE-2026-25527
  checkedAt: '2026-09-25T08:20:53.516Z'
exploitAvailable: true
---

## Overview

changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.

## Affected packages

- `changedetection-io < 0.53.2`

## Remediation

Upgrade to a patched release:

- `changedetection-io 0.53.2`