CVE-2026-35000 ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read

What is CVE-2026-35000?

CVE-2026-35000 is a high-severity path traversal vulnerability in dgtlmoon ChangeDetection.io, published on 1 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

Weakness: CWE-184

Which versions are affected by CVE-2026-35000?

1 open source package ship an affected version, including changedetection-io. It affects 1 product.

Products include Webtechnologies Changedetection.

How do I fix CVE-2026-35000?

Upgrade changedetection-io to 0.54.7 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-35000 being exploited?

There is no known exploitation of CVE-2026-35000 in the wild and no public exploit code.

Other vulnerabilities in dgtlmoon ChangeDetection.io

• CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering Critical 9.8
• CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text() High 8.8
• CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality High 8.8
• CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs High 8.6
• CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x3f8-2w95-hw4m, PYSEC-2026-2131.