changedetection.io EUVD-2026-84365

Requires network reachability to a changedetection.io instance version 0.60.7 or earlier exposing the Screenshot Handler / static_content route; no authentication is required per the vector (PR:N) and no user interaction (UI:N). Exploitation is meaningfully LIMITED by high attack complexity (AC:H) and a 'difficult' exploitability rating per VulDB - implying encoding, path-normalization, or scope constraints - and by the confidentiality-only, low-magnitude impact (VC:L), so successful attacks disclose limited files rather than sensitive secrets or achieve write/RCE. Many deployments sit behind a reverse proxy or optional password/authentication, which further reduces exposure of the vulnerable endpoint.

This is a moderate, not high-priority, issue despite the CWE-22 label. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) and the 6.3 medium score are internally consistent with the narrative: the path traversal is remote and pre-authentication (PR:N) but explicitly rated high complexity, and VulDB describes exploitability as 'difficult.' Crucially, impact is confidentiality-only and rated LOW (VC:L, no integrity or availability), meaning this yields constrained file disclosure rather than full arbitrary file read leading to secrets/RCE. The SSVC/threat signal E:P ('Proof-of-Concept') aligns with the public GitHub exploit - so exploit code exists, but this is NOT the same as active exploitation. No EPSS score is provided and there is no CISA KEV listing, so there is no evidence of widespread or targeted in-the-wild use. Signals are consistent (no conflict): public POC + medium CVSS + high attack complexity + confidentiality-only impact = a real but low-urgency bug. Note the sole intelligence source is VulDB (vendor did not respond and there is no NVD/vendor advisory), so version boundaries and impact severity are single-sourced and should be independently verified against the changedetection.io codebase before treating as confirmed.

A remote attacker who can reach a self-hosted changedetection.io instance (<=0.60.7) crafts a request to the Screenshot Handler's static_content endpoint with a manipulated 'filename' parameter containing traversal sequences to read files outside the intended screenshot directory. A public proof-of-concept exists (GitHub herantong/cve), but the CVSS high attack complexity and 'difficult' exploitability rating suggest non-trivial preconditions (e.g., encoding/normalization hurdles or limited readable scope), and impact is confined to low-sensitivity confidentiality disclosure.