Back to Database
Status published
Medium
CVE-2024-51483
changedetection.io Path Traversal vulnerability
Vulnerability Description
changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51483
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-cwgg-57xj-g77r
- https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/model/Watch.py#L19
- https://github.com/dgtlmoon/changedetection.io/blob/master/changedetectionio/processors/__init__.py#L35
- https://github.com/user-attachments/files/17591630/CL-ChangeDetection.io.Path.Travsersal-311024-181039.pdf
More from dgtlmoon
View All →CVE-2025-62780
changedetection.io vulnerable to stored XSS in Watch update via API
Low
3.5
CVE-2025-52558
ChangeDetection.io XSS in watch overview
High
7
CVE-2024-56509
changedetection.io has Improper Input Validation Leading to LFR/Path Traversal
High
8.6
CVE-2024-51998
Path traversal using file URI scheme without supplying hostname in changedetection.io
High
8.6
CVE-2024-34061
Reflected cross site scripting in changedetection.io
Medium
4.3
Affected Vendor
dgtlmoon
View all reports →Affected Software
changedetection.io
Vulnerable Versions:
< 0.47.5
Timeline
Official Publish:
November 1st, 2024
Last Modified:
November 1st, 2024
Added to House:
July 22nd, 2026