by Kastro
Paper/Archive/CVE-2026-29065

CVE-2026-29065

dgtlmoon changedetection.io — changedetection.io: Zip Slip vulnerability in the backup restore functionality

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 45.9.459 × 209.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.

Affected

ProductAffectedFixed inSource
changedetection.io< 0.54.4–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9refgithub.com/dgtlmoon/changedetection.io/commit/1d7d812eb0faab37042246e2fbce04f29bb1b3aarefgithub.com/dgtlmoon/changedetection.io/releases/tag/0.54.4