Description
changedetection.io 是一个开源的网页变更检测与监控工具，支持用户监控指定网页的变更情况，提供邮件、Slack、Discord 等多种通知方式，广泛应用于信息变更追踪和竞品监控等场景。changedetection.io 存在目录遍历漏洞，攻击者可通过 /static/ 接口读取应用目录下的任意 Python 源代码文件。
changedetection.io /static/%2e%2e/flask_app.py 目录遍历漏洞（CVE-2026-25527）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-9jj8-v89v-xjvw
https://nvd.nist.gov/vuln/detail/CVE-2026-25527
https://security.snyk.io/vuln/SNYK-PYTHON-CHANGEDETECTIONIO-15325860
https://radar.offseq.com/threat/cve-2026-25527-cwe-22-improper-limitation-of-a-pat-fbd70c8f
https://www.miggo.io/vulnerability-database/cve/CVE-2026-25527
https://advisories.gitlab.com/pypi/changedetection.io/CVE-2026-25527/
https://osv.dev/vulnerability/PYSEC-2026-2124
https://www.sentinelone.com/vulnerability-database/cve-2026-25527/