{"id":"CVE-2024-51998","aliases":["GHSA-6jrf-rcjf-245r","PYSEC-2026-1239"],"url":"https://o3.security/vulnerability/CVE-2024-51998","summary":"Path traversal using file URI scheme without supplying hostname in changedetection.io","details":"### Summary\n\nThe validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and `ALLOW_FILE_URI` false or not defined.\n\n### Details\n\nThe check used for URL protocol, `is_safe_url`, allows `file:` as a URL scheme:\n\nhttps://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13\n\nIt later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with `file://`. The issue comes with the fact that the file URI scheme is not required to have double slashes.\n\n> A valid file URI must therefore begin with either `file:/path` (no hostname), `file:///path` (empty hostname), or `file://hostname/path`.\n> — [Wikipedia](https://en.wikipedia.org/wiki/File_URI_scheme#Number_of_slash_characters)\n\nhttps://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/processors/__init__.py#L37-L41\n\n### PoC\n\n1. Open up a changedetection.io instance with a webdriver configured\n2. Create a new watch: `file:/etc/passwd` or a similar path for your operating system. Enable webdriver mode\n3. Wait for it to be checked\n4. Open preview\n5. Notice contents of the file\n","published":"2024-11-07T23:34:07.183Z","modified":"2026-10-28T02:30:29.937704539Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"changedetection-io","fixedVersion":"0.47.6"}],"fix":{"url":"https://github.com/dgtlmoon/changedetection.io/commit/49bc982c697169c98b79698889fb9d26f6b3317f","label":"dgtlmoon/changedetection.io@49bc982"},"references":[{"type":"WEB","url":"https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51998.json"},{"type":"ADVISORY","url":"https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6jrf-rcjf-245r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51998"},{"type":"FIX","url":"https://github.com/dgtlmoon/changedetection.io/commit/49bc982c697169c98b79698889fb9d26f6b3317f"},{"type":"PACKAGE","url":"https://github.com/dgtlmoon/changedetection.io"},{"type":"WEB","url":"https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/processors/__init__.py#L37-L41"},{"type":"WEB","url":"https://github.com/dgtlmoon/changedetection.io/releases/tag/0.47.06"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:29.937704539Z"}}