{"action":"Upgrade changedetection-io to 0.53.2 or later.","affected":[{"fixed":"0.53.2","introduced":"0"}],"component":"changedetection-io","cve_ids":["CVE-2026-25527"],"ecosystem":"PyPI","epss":0.01025,"exploited":false,"fixed_versions":["0.53.2"],"ghsa_id":"GHSA-9jj8-v89v-xjvw","id":"tcs_01M5KGXKWC5HJ6CMW29RT7V9W5","modified_at":"2026-07-13T07:15:16.972888298Z","published_at":"2026-02-19T15:16:11.947Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2124","https://github.com/dgtlmoon/changedetection.io/commit/9d38b4517364831889b5b0d7b3465fd060403fd4","https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-9jj8-v89v-xjvw"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-2124","url":"https://osv.dev/vulnerability/PYSEC-2026-2124"}],"summary":"changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=\"..\"`, which causes `send_from_directory(\"st"}