CVE-2026-43891
HighSummary
In the changedetection.io web page change detection tool prior to version 0.55.1, a vulnerability exists due to trusting attacker-controlled snapshot paths restored from backup files. When a backup is restored, the application may restore malicious files, including history.txt, leading to the disclosure of local file contents.
Risk Assessment
Organizations may be exposed to sensitive data disclosure as an attacker can manipulate files restored from backups. This could lead to serious security breaches and loss of information confidentiality.
Recommendation
It is recommended to upgrade to version 0.55.1 or later to mitigate this vulnerability. Additionally, implement access controls on backup files to minimize the risk of restoring malicious files.
Other vulnerabilities in changedetection.io
See all- CVE-2026-41895High
In versions 0.54.9 and earlier, changedetection.io switches to XML mode for XML/RSS content, leading to potential security issues related to processing untrusted XML data.
- CVE-2026-71205Medium
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
- CVE-2026-71204Medium
In changedetection.io, the /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
- CVE-2026-71203Medium
In changedetection.io, REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec, whose get method carries neither @auth.check_token nor @validate_openapi_request.
- CVE-2026-35000Medium
A vulnerability in ChangeDetection.io before version 0.54.7 allows bypassing protections in the SafeXPath3Parser. Attackers can read arbitrary local files using unblocked XPath 3.0/3.1 functions like json-doc().
Original NVD description (English source)
changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.