A path traversal vulnerability was identified in the static_content function of the changedetectionio/flask_app.py file in dgtlmoon changedetection.io up to version 0.60.7. By manipulating the filename argument, an attacker can remotely exploit this flaw to traverse directories outside the intended path. This vulnerability is separate from CVE-2026-25527, which addressed a different parameter in the same function. The vendor was contacted but did not provide a response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, low confidentiality impact, and no integrity or availability impact.

Successful exploitation allows an attacker to perform path traversal remotely, potentially accessing files outside the intended directory structure. The impact is rated medium with a CVSS 4.0 score of 5.3, indicating limited confidentiality impact and no integrity or availability impact. There is no evidence of active exploitation in the wild.

No official patch or remediation has been provided by the vendor as of the latest information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected service and monitor for suspicious activity related to path traversal attempts targeting the filename parameter.