Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

changedetection.io: Unvalidated XPath Expressions Expose File Access

CVE-2026-29039 GHSA-6fmw-82m7-jq6p GHSA-6fmw-82m7-jq6p
Summary

A security issue in changedetection.io allowed unauthorized access to files accessible by the application. This could have put sensitive data at risk. The issue has been fixed in version 0.54.4, so update to this version or later to protect your data.

What to do
  • Update changedetection.io to version 0.54.4.
  • Update dgtlmoon changedetection-io to version 0.54.4.
Affected software
VendorProductAffected versionsFix available
– changedetection.io <= 0.54.3 0.54.4
dgtlmoon changedetection-io <= 0.54.4 0.54.4
webtechnologies changedetection <= 0.54.4 –
Original title
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via...
Original description
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions are processed using the elementpath library which implements XPath 3.0/3.1 specification. XPath 3.0 includes the unparsed-text() function which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. This issue has been patched in version 0.54.4.
nvd CVSS4.0 8.8
Vulnerability type
CWE-94 Code Injection
Published: 6 Mar 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026