changedetection.io CVE-2026-95273

Requires a valid low-privilege authenticated session (PR:L) on a network-reachable changedetection.io instance at version 0.60.7 or earlier, plus the ability to reach the visual_selector_data / static_content endpoint. No user interaction is needed (UI:N). Exploitation is limited by the authentication requirement (not exploitable pre-auth) and by confidentiality-only impact (file read, no write/execution); actual value depends on what files the traversal can reach. No patched version is confirmed available since the vendor did not respond.

This is a genuine but modest-priority issue. The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a remotely reachable, low-complexity path traversal that requires low-privilege authentication (PR:L) and yields only limited confidentiality impact (VC:L) with no integrity or availability effect. The E:P (Proof-of-Concept) exploit maturity aligns with the reported publicly available exploit code (herantong GitHub POC), so exploitability is confirmed at the POC level but there is NO evidence of active exploitation - not listed in CISA KEV and no EPSS score was provided in the input. POC availability and active exploitation are distinct signals; only the former applies here. Two signals slightly elevate concern beyond the raw score: (1) this is an incomplete-fix sibling of CVE-2026-25527, which patched a different parameter (group) in the exact same static_content function, suggesting the fix surface was not fully hardened; and (2) the vendor was contacted but did not respond, so no patch is confirmed available. Conversely, the limited confidentiality-only impact and the requirement for an authenticated (PR:L) session keep real-world risk in the LOW-to-MEDIUM band. Data caveat: sourcing is VulDB-only with no independent NVD/vendor corroboration, and VC:L may understate impact if the traversal permits arbitrary file read (e.g., app secrets) rather than restricted file types - verify the actual read scope against the code.

An authenticated low-privilege user of a changedetection.io instance sends a crafted request to the visual_selector_data endpoint with a manipulated filename argument containing path-traversal sequences, causing the static_content handler to serve a file outside the intended directory. A public proof-of-concept exists (herantong GitHub), lowering the barrier to reproduction. Because the CVSS vector is AV:N/AC:L, the request can be delivered remotely over the network with low complexity once the attacker holds any valid low-privilege account.