The vulnerability allows an attacker to read any file on the system by crafting a backup ZIP that contains paths pointing to arbitrary files. During restore, the application copies each watch directory directly into the live datastore, preserving the attacker‑controlled file structure, and then parses a history file that can be manipulated to expose local file contents. This flaw is a classic Local File Inclusion type, classified as CWE‑73, and can potentially expose configuration files, credentials, or other sensitive information.

The affected product is changedetection.io from dgtlmoon. Versions prior to 0.55.1 are vulnerable; the issue was addressed in release 0.55.1.

The CVSS score of 7.5 indicates a moderate‑to‑high severity. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker providing a crafted backup file to an administrator who has permission to restore backups, leading to arbitrary local file read. While the flaw does not allow remote code execution, gaining access to local files can still compromise confidentiality and potentially extend to higher privilege operations if sensitive files are disclosed.