Arbitrary File Read Vulnerability in Changedetection.io by dgtlmoon

CVE-2026-29039

What is CVE-2026-29039?

The Changedetection.io application, a free open-source tool for detecting webpage changes, suffered from a vulnerability that allows users to input unvalidated XPath expressions via the include_filters field. The elementpath library, used for processing these expressions, implements the XPath 3.0/3.1 specification, which includes the unparsed-text() function capable of reading files from the server's filesystem. This lack of validation allows attackers to exploit this flaw and read any accessible file within the application process's permissions, thus posing a serious security risk. The vulnerability has been addressed in version 0.54.4.

References