GHSA-9jj8-v89v-xjvw changedetection.io is vulnerable to unauthenticated static path traversal

• PyPI changedetection.io: < 0.53.2 → fixed in 0.53.2

Summary The `/static//` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Severity is low information disclosure (C:L). Details The vulnerable code is in `changedetectionio/flask_app.py` inside `static_content()`: ``` group = re.sub(r'[^\w.-]+', '', group.lower()) filename = re.sub(r'[^\w.-]+', '', filename.lower()) ... return send_from_directory(f"static/{group}", path=filename) ``` The `group` sanitization allows dots, so `group=".."` passes validation. This results in `send_from_directory("static/..", filename)`, effectively shifting the base directory to `/app/changedetectionio` and allowing reads of files in that directory. The route is unauthenticated, so any user can retrieve source files without logging in. > Limitation: the route only matches `/static//` and rejects slashes inside `filename`, so it cannot traverse further to arbitrary system paths like `/etc/passwd`. It is limited to files inside the application package directory. PoC 1) Start an instance (example: Docker on port 5050) ``` docker run -d --name cdio -p 127.0.0.1:5050:5000 -v cdio-data:/datastore cdio-local ``` 2) Reproduce (URL-encoded traversal) ``` curl -i http://127.0.0.1:5050/static/%2e%2e/flask_app.py ``` (curl path passthrough) ``` curl --path-as-is -i http://127.0.0.1:5050/static/../flask_app.py ``` 3) Observe that the response body contains Python source code from `flask_app.py`. Impact • Vulnerability type: Directory Traversal / Local File Read • Affected users: Anyone with network access (no authentication required) • Scope: Source files under `/app/changedetectionio` • Security impact: Internal logic exposure can aid further exploitation (Confidentiality: Low)