changedetection.io has an Arbitrary Local File Read via a crafted backup restore

The second vulnerable step is in get_history_snapshot(). Once the untrusted path has been accepted into the watch history, the application reads the resolved path directly without enforcing that it remains inside the watch directory.

Relevant code:

• changedetectionio/model/Watch.py

That function eventually performs direct file reads such as:

with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
    return f.read()

The third step is reachability. The trusted history entry is consumed by both the Preview UI and the watch history API.

Relevant code:

• changedetectionio/blueprint/ui/preview.py
• changedetectionio/api/Watch.py

In the Preview flow, the application selects the latest history timestamp and calls:

content = watch.get_history_snapshot(timestamp=timestamp)

In the API flow, the application also calls:

content = watch.get_history_snapshot(timestamp=timestamp)

This creates the following end-to-end exploit chain:

1. An attacker supplies a crafted backup ZIP.
2. The restore process preserves attacker-controlled history.txt.
3. The history.txt parser accepts an absolute or out-of-directory path if that path exists.
4. Preview or the history API dereferences the stored path directly.
5. The application returns the contents of the targeted local file.

The root cause is that imported history entries are treated as trusted filesystem paths instead of being restricted to safe basenames under watch.data_dir.

PoC

The following proof of concept demonstrates the end-to-end exploit chain. It assumes the attacker has gained access to the backup restore functionality to upload the crafted archive.

1. Create a normal watch in the UI, for example:

https://example.com

2. Trigger at least one successful check so the watch generates a valid history entry and can later be included in a backup.

3. Go to the Backups section and create a backup archive.

4. Extract the backup archive and identify the watch UUID directory that contains the target watch's watch.json. For example:

5db3d3d8-71e6-4db2-a81e-e1f0445c3e47

5. Open that watch directory and edit history.txt.

6. Replace the latest history entry with a path to an existing local file that is readable by the application process. For example:

1776969188,/etc/passwd

If the timestamp differs in the extracted backup, keep the original latest timestamp and only replace the filename/path portion.

Example:

1776969188,742215043ff9be7e635f05e680ff9b11.txt

becomes:

1776969188,/etc/passwd

7. Repack the backup so that the UUID directories are located at the root of the ZIP archive.

Important:

• Do not add an extra parent directory layer when repacking.
• The archive root should contain directories such as:

<watch-uuid>/
<group-uuid>/
changedetection.json
url-list.txt

8. In the UI, restore the modified backup and enable replacement of existing watches with the same UUID.

9. After restore completes, open Preview for the restored watch.

10. The application will read the attacker-controlled path from history.txt and display the contents of the referenced local file instead of the original watch snapshot.

Observed result:

• The Preview page returns the content of the attacker-selected local file.

Expected result:

• The application should reject absolute paths or out-of-directory paths restored from history.txt.
• Snapshot history should be restricted to files within the watch's own data directory.

Optional API verification:

• The same issue can also be confirmed through the watch history API by requesting the modified timestamp after restore.
• The API returns the same file content because it also calls watch.get_history_snapshot(timestamp=timestamp) on the trusted history entry.

Impact

This is an arbitrary local file disclosure vulnerability reachable through malicious backup restore content.

Who is impacted:

• Deployments where the application process has read access to sensitive local system files.
• Docker or host-mounted environments where secrets, config files, or operational artifacts are explicitly readable by the service.

What can be exposed:

• Arbitrary System Files: Core operating system files (e.g., /etc/passwd, /proc/self/environ), system-level configurations, and host metrics.
• Application Data: Internal records and files residing under the /datastore directory.
• Secrets & Artifacts: Application-local configuration files, API tokens, database credentials, and other sensitive artifacts accessible to the application process.

By accessing the backup restore functionality and importing a crafted archive, an attacker can exploit the application's fail-open path validation. The confidentiality impact is exceptionally high because, once the payload is ingested, the application can be manipulated to disclose arbitrary local system files and highly sensitive environment variables directly through standard UI or API responses.

Recommendation

The application should treat all paths restored from history.txt as untrusted input.

The root cause is in changedetectionio/model/Watch.py, where values containing path separators are currently accepted as filesystem paths and preserved if the referenced file already exists.

The fix should be:

1. Never trust absolute or external paths from history.txt.
2. Normalize every history entry to os.path.basename(v).
3. Join the normalized filename to self.data_dir.
4. Skip the entry if the resolved file does not exist inside the watch directory.

Suggested code change:

snapshot_fname = os.path.basename(v.strip())
resolved_path = os.path.join(self.data_dir, snapshot_fname)

if not os.path.exists(resolved_path):
    logger.warning(
        f"Skipping unsafe or missing history entry for {self.get('uuid')}: {v!r}"
    )
    continue

tmp_history[k] = resolved_path

This ensures restored history entries can only reference files inside the watch's own data directory and prevents arbitrary local file reads through Preview or the history API.