CVE-2026-43891 changedetection.io: Arbitrary Local File Read via crafted backup restore
An attacker can read arbitrary local files by restoring a crafted backup archive containing malicious snapshot paths in changedetection.io.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43891?
CVE-2026-43891 is a high-severity path traversal vulnerability in dgtlmoon changedetection.io, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.
Weakness: CWE-73
Which versions are affected by CVE-2026-43891?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.55.1 |
changedetection-io PyPI | All versions | 0.55.1 |
changedetection-io PyPI | All versions | 0.55.1 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2026-43891?
Upgrade changedetection.io to 0.55.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-43891 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43891 exists.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Sources
Also known as GHSA-8757-69j2-hx56, PYSEC-2026-30.