PYSEC-2026-1239
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/changedetection-io/PYSEC-2026-1239.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1239
- Aliases
- Published
- 2026-07-07T14:34:44Z
- Modified
- 2026-07-07T17:47:24Z
- Severity
-
- 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
- Summary
- changedetection.io path traversal using file URI scheme without supplying hostname
- Details
-
Summary
The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and
ALLOW_FILE_URIfalse or not defined.Details
The check used for URL protocol,
is_safe_url, allowsfile:as a URL scheme:It later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with
file://. The issue comes with the fact that the file URI scheme is not required to have double slashes.A valid file URI must therefore begin with either
file:/path(no hostname),file:///path(empty hostname), orfile://hostname/path. — WikipediaPoC
- Open up a changedetection.io instance with a webdriver configured
- Create a new watch:
file:/etc/passwdor a similar path for your operating system. Enable webdriver mode - Wait for it to be checked
- Open preview
- Notice contents of the file
- References
-
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6jrf-rcjf-245r
- https://nvd.nist.gov/vuln/detail/CVE-2024-51998
- https://github.com/dgtlmoon/changedetection.io/commit/49bc982c697169c98b79698889fb9d26f6b3317f
- https://github.com/dgtlmoon/changedetection.io
- https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13
- https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/processors/__init__.py#L37-L41
- https://github.com/dgtlmoon/changedetection.io/releases/tag/0.47.06
- https://pypi.org/project/changedetection-io
- https://github.com/advisories/GHSA-6jrf-rcjf-245r
Affected packages
PyPI / changedetection-io
Package
- Name
- changedetection-io
- View open source insights on deps.dev
- Purl
- pkg:pypi/changedetection-io
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.47.6
Affected versions
0.*
0.38.2
0.39
0.39.1
0.39.2
0.39.3
0.39.4
0.39.5
0.39.6
0.39.7
0.39.8
0.39.9
0.39.10
0.39.10.post1
0.39.10.post2
0.39.11
0.39.12
0.39.13
0.39.13.1
0.39.14
0.39.14.1
0.39.15
0.39.16
0.39.17
0.39.17.1
0.39.17.2
0.39.18
0.39.19
0.39.19.1
0.39.20
0.39.20.1
0.39.20.2
0.39.20.3
0.39.20.4
0.39.21
0.39.21.1
0.39.22
0.39.22.1
0.40.0
0.40.0.1
0.40.0.2
0.40.0.3
0.40.0.4
0.40.1.0
0.40.1.1
0.40.2
0.40.3
0.41
0.41.1
0.42
0.42.1
0.42.2
0.42.3
0.43.1
0.43.2
0.44
0.44.1
0.45
0.45.1
0.45.2
0.45.3
0.45.4
0.45.5
0.45.6
0.45.7
0.45.7.1
0.45.7.2
0.45.7.3
0.45.8
0.45.8.1
0.45.9
0.45.11
0.45.12
0.45.13
0.45.14
0.45.15
0.45.16
0.45.17
0.45.18
0.45.19
0.45.20
0.45.21
0.45.22
0.45.23
0.45.24
0.45.25
0.45.26
0.46.0
0.46.1
0.46.2
0.46.3
0.46.4
0.47.0
0.47.1
0.47.2
0.47.3
0.47.4
0.47.5