CVSS 4.0
8.8 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:PCVE-2026-29065
High (8.8) in webtechnologies changedetection. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in changedetection-io 0.54.4.
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.
Severity
CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- webtechnologies:changedetection
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-25g8-2mcf-fcx9 | PyPI | changedetection-io | <0.54.4 | 0.54.4 |
| PYSEC-2026-2129 | PyPI | changedetection-io | <0.54.4 | 0.54.4 |