CVE-2026-95273 Details

A path traversal vulnerability has been identified in dgtlmoon changedetection.io versions through 0.60.7. The issue arises in the static_content function of changedetectionio/flask_app.py, specifically within the visual_selector_data group. The vulnerability allows remote attackers to manipulate the filename parameter, escape the intended directory, and access unauthorized files, such as elements.deflate from other watches. This vulnerability was publicly disclosed and is distinct from CVE-2026-25527, which addressed a different parameter in the same function.

To address this vulnerability, validate the filename parameter as a watch UUID before constructing the file path. Implement a lookup to ensure the watch exists and add normalization and base directory validation to prevent traversal outside the intended directory. Additionally, update security tests to cover the visual_selector_data branch.