CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
Attackers can overwrite arbitrary files via path traversal in uploaded ZIP archives during backup restore, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29065?
CVE-2026-29065 is a high-severity path traversal vulnerability in dgtlmoon changedetection.io, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.
Weakness: CWE-22
Which versions are affected by CVE-2026-29065?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.54.4 |
changedetection-io PyPI | All versions | 0.54.4 |
changedetection-io PyPI | All versions | 0.54.4 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2026-29065?
Upgrade changedetection.io to 0.54.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-29065 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29065 exists.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
- CVE-2026-41895 changedetection.io: XXE vulnerability in the changedetection.io project
Sources
Also known as GHSA-25g8-2mcf-fcx9, PYSEC-2026-2129.