GHSA-9jj8-v89v-xjvw: changedetection.io is vulnerable to unauthenticated static path traversal

Summary The /static/<group>/<filename> route accepts group="..", which causes send_from_directory("static/..", filename) to execute. This moves the base directory up to /app/changedetectionio, enabling unauthenticated local file read of application source files (e.g., flask_app.py). Severity is low information disclosure (C:L). Details The vulnerable code is in changedetectionio/flask_app.py inside static_content(): group = re.sub(r'[^\w.-]+', '', group.lower()) filename = re.sub(r'[^\w.-]+', '', filename.lower()) ... return send_from_directory(f"static/{group}", path=filename) The group sanitization allows dots, so group=".." passes validation. This results in send_from_directory("static/..", filename), effectively shifting the base directory to /app/changedetectionio and allowing reads of files in that directory. The route is unauthenticated, so any user can retrieve source files without logging in. Limitation: the route only matches /static/<group>/<filename> and rejects slashes inside filename, so it cannot traverse further to arbitrary system paths like /etc/passwd. It is limited to files inside the application package directory. PoC 1) Start an instance (example: Docker on port 5050) docker run -d --name cdio -p 127.0.0.1:5050:5000 -v cdio-data:/datastore cdio-local 2) Reproduce (URL-encoded traversal) curl -i http://127.0.0.1:5050/static/%2e%2e/flask_app.py (curl path passthrough) curl --path-as-is -i http://127.0.0.1:5050/static/../flask_app.py 3) Observe that the response body contains Python source code from flask_app.py. Impact - Vulnerability type: Directory Traversal / Local File Read - Affected users: Anyone with network access (no authentication required) - Scope: Source files under /app/changedetectionio - Security impact: Internal logic exposure can aid further exploitation (Confidentiality: Low)