Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the static_content function located in changedetectionio/flask_app.py. The initial vulnerability description explicitly pointed to this function and the provided commit hash confirmed it. The patch replaces a permissive regular expression [^\\w.-]+ with a much stricter one [^a-z0-9_]+ for sanitizing the group and filename parameters. The original regex allowed dots, which an attacker could use to construct a .. path segment for the group parameter. This traversed up one level from the intended static/ directory, allowing unauthenticated access to application source files within the parent directory. The fix prevents this by disallowing dots in the group and filename parameters.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| changedetection.io | pip | < 0.53.2 | 0.53.2 |
flask_app.py./app/changedetectionio