CVE-2026-95272

Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8

Description A path traversal issue exists in the Screenshot Handler component within the static content() function of the changedetectionio/flask app.py file. A remote attacker can exploit this by manipulating the filename argument to access files outside the intended directory. This attack is characterized by high complexity and difficult exploitability.

Recommendations Update dgtlmoon changedetection.io to a version newer than 0.60.7. As a temporary mitigation, restrict access to the static content() function within the Screenshot Handler component.