CVE-2026-29065: changedetection.io: Zip Slip vulnerability in the backup restore functionality

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-06 · updated 2026-06-17
Weakness: CWE-22

Description

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.

Affected products

dgtlmoon changedetection.io: before 0.54.4 — fixed in 0.54.4

How to fix

Upgrade to a fixed version: dgtlmoon changedetection.io 0.54.4. Check the vendor advisory for mitigations.

References

https://github.com/dgtlmoon/changedetection.io/commit/1d7d812eb0faab37042246e2fbce04f29bb1b3aa
https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4
https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9

Get alerted when CVE-2026-29065 or the next vulnerability affects your stack