The vulnerability is a path traversal flaw in the Screenshot Handler’s static_content function within dgtlmoon changedetection.io. By manipulating the filename parameter, an attacker can cause the server to resolve file paths outside the intended directory, allowing remote retrieval of arbitrary files that may contain sensitive configuration or credentials. The flaw is rated CVSS 6.3 and is publicly disclosed with high complexity, indicating that while the exploit is non‑trivial, a skilled attacker can carry it out.

Affected installations are those running changedetection.io up to and including version 0.60.7. All deployments of the open‑source product built from the official source are susceptible, as the path traversal exists in the static_content routine of changedetectionio/flask_app.py. No specific patch version is provided in the advisory, so users should review the repository release notes or apply the latest stable release.

The risk is moderate. The vulnerability can be triggered remotely via the exposed web endpoint; the exploit complexity is high and reported as difficult, yet the possibility of reading sensitive files can lead to further compromise. Administrators should assess whether the same functionality is exposed externally or requires authentication. The EPSS score is not available and the vulnerability is not listed in CISA KEV.