https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:32:19 +0000 https://vulnerability.circl.lu/vuln/cve-2024-51483 <p><strong>Affected:</strong> dgtlmoon changedetection.io, changedetection</p> <p>changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.</p> <p><strong>Affected:</strong> dgtlmoon changedetection.io, changedetection</p> <p>changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2024-51483 https://vulnerability.circl.lu/vuln/ghsa-cwgg-57xj-g77r <p><strong>Affected:</strong> PyPI: changedetection.io</p> <p>### Summary When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked</p> <p>### Details The root cause is the payload source:file:///etc/passwdpasses the regex [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19) and also passes the check [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35) where a traditional file:///etc/passwd would get blocked</p> <p>### PoC [CL-ChangeDetection.io Path Travsersal-311024-181039.pdf](https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf)</p> <p>### Impact It depends on where the webdriver is deployed but generally this is a high impact vulnerability</p> <p><strong>Affected:</strong> PyPI: changedetection.io</p> <p>### Summary When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked</p> <p>### Details The root cause is the payload source:file:///etc/passwdpasses the regex [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19) and also passes the check [here](https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35) where a traditional file:///etc/passwd would get blocked</p> <p>### PoC [CL-ChangeDetection.io Path Travsersal-311024-181039.pdf](https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf)</p> <p>### Impact It depends on where the webdriver is deployed but generally this is a high impact vulnerability</p> https://vulnerability.circl.lu/vuln/ghsa-cwgg-57xj-g77r