CVE-2026-95656

In the changedetection.io web page change detection tool prior to version 0.55.1, a vulnerability exists due to trusting attacker-controlled snapshot paths restored from backup files. When a backup is restored, the application may restore malicious files, including history.txt, leading to the disclosure of local file contents.

In versions 0.54.9 and earlier, changedetection.io switches to XML mode for XML/RSS content, leading to potential security issues related to processing untrusted XML data.

A vulnerability in Changedetection.io up to 0.55.8. The function setCurrentSelectedText in visual-selector.js is affected. Manipulating the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 0.60.1 addresses the issue. The patch is aac6fcfa594f17511b8ff73e5eaa4f6c33899de0.

A path traversal vulnerability was found in changedetection.io up to version 0.60.7, affecting the static_content function in changedetectionio/flask_app.py within the visual_selector_data component. Manipulating the filename argument allows remote exploitation. The exploit has been publicly disclosed and may be used by attackers.

changedetection.io up to version 0.60.7 has a path traversal vulnerability in the static_content function in changedetectionio/flask_app.py in the Screenshot Handler component. Manipulating the filename argument allows a remote attack with high complexity and difficult exploitability. The exploit has been published, but the vendor did not respond.

A vulnerability was found in changedetection.io up to 0.60.7 in the check_authentication function of changedetectionio/flask_app.py within the Authentication Hook component. Improper validation leads to improper authentication, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used; the vendor did not respond to the disclosure.

changedetection.io up to version 0.60.7 has a vulnerability involving an observable timing discrepancy in the check_password function in changedetectionio/flask_app.py in the Hash Comparison component. The attack can be performed remotely, requires high complexity, and is difficult to exploit. The exploit has been published, and the vendor did not respond.

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).