CVE-2026-29039CWE-94

changedetection.io: XPath - Arbitrary File Read via unparsed-text()

High · published March 6, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions are processed using the elementpath library which implements XPath 3.0/3.1 specification. XPath 3.0 includes the unparsed-text() function which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. This issue has been patched in version 0.54.4.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00528 · 43.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-03-06T06:54Z
EPSS history
Timeline
  • 06 MAR 06:54Z
    changedetection.io: XPath - Arbitrary File Read via unparsed-text()
    cvelistv5