https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T17:32:19.472778+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2024-51483 CVE-2024-51483 — changedetection.io Path Traversal vulnerability 2026-10-02T17:32:19.475910+00:00

Affected: dgtlmoon changedetection.io, changedetection

changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.

 https://vulnerability.circl.lu/vuln/ghsa-cwgg-57xj-g77r GHSA-cwgg-57xj-g77r — changedetection.io Path Traversal 2026-10-02T17:32:19.476084+00:00

Affected: PyPI: changedetection.io

### Summary When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked

### Details The root cause is the payload source:file:///etc/passwdpasses the regex [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19) and also passes the check [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35) where a traditional file:///etc/passwd would get blocked

### PoC [CL-ChangeDetection.io Path Travsersal-311024-181039.pdf](https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf)

### Impact It depends on where the webdriver is deployed but generally this is a high impact vulnerability