Log in Start free

Vulnerability · Published Mar 6, 2026 · Assigned by GitHub_M

CVE-2026-29039changedetection.io: XPath - Arbitrary File Read via unparsed-text()

High 8.8

In plain English

A high-severity code injection in changedetection.io from dgtlmoon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.8High
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions are processed using the elementpath library which implements XPath 3.0/3.1 specification. XPath 3.0 includes the unparsed-text() function which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. This issue has been patched in version 0.54.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIchangedetection-io0.54.4GHSA-6fmw-82m7-jq6p
PyPIchangedetection-io0.54.4PYSEC-2026-2128

Affected products (as reported)

VendorProductVersions
dgtlmoon changedetection.io < 0.54.4

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

References