CVE-2026-29065

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29065
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/dgtlmoon/changedetection.io/commit/1d7d812eb0faab37042246e2fbce04f29bb1b3aa Patch
https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4 Product Release Notes
https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*
History

10 Mar 2026, 20:00

Type Values Removed Values Added
References () https://github.com/dgtlmoon/changedetection.io/commit/1d7d812eb0faab37042246e2fbce04f29bb1b3aa - () https://github.com/dgtlmoon/changedetection.io/commit/1d7d812eb0faab37042246e2fbce04f29bb1b3aa - Patch
References () https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4 - () https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4 - Product, Release Notes
References () https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9 - () https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9 - Exploit, Vendor Advisory
Summary
  • (es) changedetection.io es una herramienta gratuita de código abierto para la detección de cambios en páginas web. Antes de la versión 0.54.4, una vulnerabilidad Zip Slip en la funcionalidad de restauración de copias de seguridad permite la sobrescritura arbitraria de archivos mediante salto de ruta en archivos ZIP subidos. Este problema ha sido parcheado en la versión 0.54.4.
First Time Webtechnologies changedetection
Webtechnologies
CPE cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1

06 Mar 2026, 07:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-06 07:16

Updated : 2026-03-10 20:00

NVD link : CVE-2026-29065

Mitre link : CVE-2026-29065

CVE.ORG link : CVE-2026-29065

JSON object : View

Products Affected

webtechnologies

  • changedetection
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')