Read the docs
TI-2026-31955 Aliases CVE-2026-43891GHSA-8757-69j2-hx56

changedetection.io: Arbitrary Local File Read via crafted backup restore

Priority HIGH 72CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-73 and the CVSS impact.

Summary

changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00354 29th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed changedetection.io (dgtlmoon): 0.55.1changedetection.io (PyPI): 0.55.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dgtlmoonchangedetection.iobefore 0.55.10.55.1Patch availableCNA
—changedetection.io (PyPI)before 0.55.10.55.1Patch availableGHSA-8757-69j2-hx56
  • changedetection.io Vendordgtlmoon Affected before 0.55.1 Fixed in 0.55.1 Patch available CNA
  • changedetection.io (PyPI) Vendor— Affected before 0.55.1 Fixed in 0.55.1 Patch available GHSA-8757-69j2-hx56

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*before 0.55.1Vulnerabledgtlmoon
  • cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:* Versions before 0.55.1 Vulnerable ·dgtlmoon

Remediation

  • Fix · CNA changedetection.io (dgtlmoon) Fixed in 0.55.1
  • Fix · GHSA-8757-69j2-hx56 changedetection.io (PyPI) Fixed in 0.55.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43891
  2. 2026-10-03 Alias added: GHSA-8757-69j2-hx56

References

Exploit 2

Advisory 1

Other 2

  • TI-2026-27619 changedetection.io has an Authentication Bypass via Decorator Ordering CVSS 3.1CRITICAL 9.8
  • TI-2026-23210 changedetection.io: Zip Slip vulnerability in the backup restore functionality CVSS 4.0HIGH 8.8
  • TI-2026-22073 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs CVSS 3.1HIGH 8.6
  • TI-2026-26322 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters CVSS 4.0HIGH 8.3
  • TI-2026-23185 changedetection.io: XPath - Arbitrary File Read via unparsed-text() CVSS 4.0HIGH 8.8
  • TI-2026-23184 changedetection.io: Reflected XSS in RSS Tag Error Response CVSS 3.1MEDIUM 6.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences