Affected: dgtlmoon changedetection.io

changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.

Affected: PyPI: changedetection.io

## Summary The `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling **unauthenticated local file read** of application source files (e.g., `flask_app.py`). Severity is **low information disclosure (C:L)**.

### Details The vulnerable code is in `changedetectionio/flask_app.py` inside `static_content()`:

``` group = re.sub(r'[^\w.-]+', '', group.lower()) filename = re.sub(r'[^\w.-]+', '', filename.lower()) ... return send_from_directory(f"static/{group}", path=filename) ```

The `group` sanitization allows dots, so `group=".."` passes validation. This results in `send_from_directory("static/..", filename)`, effectively shifting the base directory to `/app/changedetectionio` and allowing reads of files in that directory. The route is unauthenticated, so **any user can retrieve source files** without logging in.

> Limitation: the route only matches `/static/<group>/<filename>` and rejects slashes inside `filename`, so it cannot traverse further to arbitrary system paths like `/etc/passwd`. It is limited to files inside the application package directory.

### PoC 1) Start an instance (example: Docker on port 5050) ``` docker run -d --name cdio -p 127.0.0.1:5050:5000 -v cdio-data:/datastore cdio-local ```

2) Reproduce **(URL-encoded traversal)** ``` curl -i http://127.0.0.1:5050/static/%2e%2e/flask_app.py ```

**(curl path passt…