What’s Vulnerable › Vulnerabilities

CVE-2026-29039: changedetection.io: XPath - Arbitrary File Read via unparsed-text()

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-06 · updated 2026-06-17
• Weakness: CWE-94

Description

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions are processed using the elementpath library which implements XPath 3.0/3.1 specification. XPath 3.0 includes the unparsed-text() function which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. This issue has been patched in version 0.54.4.

Affected products

• dgtlmoon changedetection.io: before 0.54.4 — fixed in 0.54.4

How to fix

Upgrade to a fixed version: dgtlmoon changedetection.io 0.54.4. Check the vendor advisory for mitigations.

References

• https://github.com/dgtlmoon/changedetection.io/commit/417d57e5749441e4be9acc4010369bded805d66f
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4
• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6fmw-82m7-jq6p

Get alerted when CVE-2026-29039 or the next vulnerability affects your stack