CVE-2026-29065CWE-22

changedetection.io: Zip Slip vulnerability in the backup restore functionality

High · published March 6, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00584 · 47.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-06T06:54Z
EPSS history
Timeline
  • 06 MAR 06:54Z
    changedetection.io: Zip Slip vulnerability in the backup restore functionality
    cvelistv5