CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
Attackers can read arbitrary files from the server by injecting malicious XPath expressions into content filters, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29039?
CVE-2026-29039 is a high-severity code injection vulnerability in dgtlmoon changedetection.io, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions are processed using the elementpath library which implements XPath 3.0/3.1 specification. XPath 3.0 includes the unparsed-text() function which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. This issue has been patched in version 0.54.4.
Weakness: CWE-94
Which versions are affected by CVE-2026-29039?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.54.4 |
changedetection-io PyPI | All versions | 0.54.4 |
changedetection-io PyPI | All versions | 0.54.4 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2026-29039?
Upgrade changedetection.io to 0.54.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-29039 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29039 exists.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
- CVE-2026-41895 changedetection.io: XXE vulnerability in the changedetection.io project
Sources
Also known as GHSA-6fmw-82m7-jq6p, PYSEC-2026-2128.