https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:05:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-268854 EUVD-2026-268854 https://cve.radiocsirt.org/vuln/euvd-2026-268854 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25527 <p>changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/&lt;group&gt;/&lt;filename&gt;` route accepts `group=&#34;..&#34;`, which causes `send_from_directory(&#34;static/..&#34;, filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.</p> <p>changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/&lt;group&gt;/&lt;filename&gt;` route accepts `group=&#34;..&#34;`, which causes `send_from_directory(&#34;static/..&#34;, filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25527 https://cve.radiocsirt.org/vuln/ghsa-9jj8-v89v-xjvw <p><strong>Affected:</strong> PyPI: changedetection.io</p> <p>## Summary The `/static/&lt;group&gt;/&lt;filename&gt;` route accepts `group=&#34;..&#34;`, which causes `send_from_directory(&#34;static/..&#34;, filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling **unauthenticated local file read** of application source files (e.g., `flask_app.py`). Severity is **low information disclosure (C:L)**.</p> <p>### Details The vulnerable code is in `changedetectionio/flask_app.py` inside `static_content()`:</p> <p>``` group = re.sub(r&#39;[^\w.-]+&#39;, &#39;&#39;, group.lower()) filename = re.sub(r&#39;[^\w.-]+&#39;, &#39;&#39;, filename.lower()) ... return send_from_directory(f&#34;static/{group}&#34;, path=filename) ```</p> <p>The `group` sanitization allows dots, so `group=&#34;..&#34;` passes validation. This results in `send_from_directory(&#34;static/..&#34;, filename)`, effectively shifting the base directory to `/app/changedetectionio` and allowing reads of files in that directory. The route is unauthenticated, so **any user can retrieve source files** without logging in.</p> <p>&gt; Limitation: the route only matches `/static/&lt;group&gt;/&lt;filename&gt;` and rejects slashes inside `filename`, so it cannot traverse further to arbitrary system paths like `/etc/passwd`. It is limited to files inside the application package directory.</p> <p>### PoC 1) Start an instance (example: Docker on port 5050) ``` docker run -d --name cdio -p 127.0.0.1:5050:5000 -v cdio-data:/datastore cdio-local ```</p> <p>2) Reproduce **(URL-encoded traversal)** ``` curl -i http://127.0.0.1:5050/static/%2e%2e/flask_app.py ```</p> <p>**(curl path passt…</p> <p><strong>Affected:</strong> PyPI: changedetection.io</p> <p>## Summary The `/static/&lt;group&gt;/&lt;filename&gt;` route accepts `group=&#34;..&#34;`, which causes `send_from_directory(&#34;static/..&#34;, filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling **unauthenticated local file read** of application source files (e.g., `flask_app.py`). Severity is **low information disclosure (C:L)**.</p> <p>### Details The vulnerable code is in `changedetectionio/flask_app.py` inside `static_content()`:</p> <p>``` group = re.sub(r&#39;[^\w.-]+&#39;, &#39;&#39;, group.lower()) filename = re.sub(r&#39;[^\w.-]+&#39;, &#39;&#39;, filename.lower()) ... return send_from_directory(f&#34;static/{group}&#34;, path=filename) ```</p> <p>The `group` sanitization allows dots, so `group=&#34;..&#34;` passes validation. This results in `send_from_directory(&#34;static/..&#34;, filename)`, effectively shifting the base directory to `/app/changedetectionio` and allowing reads of files in that directory. The route is unauthenticated, so **any user can retrieve source files** without logging in.</p> <p>&gt; Limitation: the route only matches `/static/&lt;group&gt;/&lt;filename&gt;` and rejects slashes inside `filename`, so it cannot traverse further to arbitrary system paths like `/etc/passwd`. It is limited to files inside the application package directory.</p> <p>### PoC 1) Start an instance (example: Docker on port 5050) ``` docker run -d --name cdio -p 127.0.0.1:5050:5000 -v cdio-data:/datastore cdio-local ```</p> <p>2) Reproduce **(URL-encoded traversal)** ``` curl -i http://127.0.0.1:5050/static/%2e%2e/flask_app.py ```</p> <p>**(curl path passt…</p> https://cve.radiocsirt.org/vuln/ghsa-9jj8-v89v-xjvw https://cve.radiocsirt.org/vuln/pysec-2026-2124 <p><strong>Affected:</strong> PyPI: changedetection-io</p> <p>changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/&lt;group&gt;/&lt;filename&gt;` route accepts `group=&#34;..&#34;`, which causes `send_from_directory(&#34;static/..&#34;, filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.</p> <p><strong>Affected:</strong> PyPI: changedetection-io</p> <p>changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/&lt;group&gt;/&lt;filename&gt;` route accepts `group=&#34;..&#34;`, which causes `send_from_directory(&#34;static/..&#34;, filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2124