{"cve":"CVE-2026-43891","nvd":{"published":"2026-05-12T18:17:28.493","modified":"2026-10-26T18:10:00.173","status":"Analyzed","description":"changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and  returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-73"],"references":["https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8757-69j2-hx56","https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44"],"products":["webtechnologies:changedetection"],"source":"nvd","synced_at":"2026-10-26T18:27:13.530666824+00:00"},"epss":{"cve":"CVE-2026-43891","score":0.00354,"percentile":0.28858,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-8757-69j2-hx56","url":"https://osv.dev/vulnerability/GHSA-8757-69j2-hx56","summary":"changedetection.io has an Arbitrary Local File Read via a crafted backup restore","modified":"2026-07-08T08:14:41.950222612Z","packages":[{"ecosystem":"PyPI","name":"changedetection-io","purl":"pkg:pypi/changedetection-io","ranges":["<0.55.1"],"fixed":["0.55.1"]}]},{"id":"PYSEC-2026-30","url":"https://osv.dev/vulnerability/PYSEC-2026-30","summary":"","modified":"2026-06-10T17:14:15.439915060Z","packages":[{"ecosystem":"PyPI","name":"changedetection-io","purl":"pkg:pypi/changedetection-io","ranges":["<0.55.1"],"fixed":["0.55.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}