CVE-2026-29065Disclosure(webtechnologies / changedetection)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch webtechnologies changedetection systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.

webtechnologies CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/dgtlmoon/changedetection.io/commit/1d7d812eb0faab37042246e2fbce04f29bb1b3aa

Exploit / PoC references

https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9

Other references

https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

changedetection

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-03-06); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

webtechnologies

Products

changedetection

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-04	1	Patch1
2026-03-06	2	Disclosure2
2026-03-11	1	Disclosure1

Full discourse4 posts

PikaPods - Open Source Hosting@PikaPods218d
Patch
Critical security update: http://changedetection.io v0.54.4 patches XSS & file read vulnerabilities (CVE-2026-29038, CVE-2026-29065). It also adds support for Python 3.14. Release: https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4 Run it: https://pikapods.com/pods?run=changedetection #opensource #privacy #cybersecurity https://t.co/0ZqOjTu7zD
Post summary
The tweet announces a critical security update for changedetection.io v0.54.4 that fixes CVE‑2026‑29038 and CVE‑2026‑29065, addressing XSS and file‑read vulnerabilities.
00020117
1.2K followersView on X
CRAC Learning - Tech@cracbot211d
Disclosure
CVE-2026-29065 (CVSS:8.8, CRITICAL) is Analyzed. http://changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerabili..https://nvd.nist.gov/vuln/detail/CVE-2026-29065 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-29065 as a Zip Slip vulnerability in Changedetection.io before version 0.54.4, noting its CVSS score and severity but offering no evidence of exploitation or mitigation.
0000030
172 followersView on X
CVE@CVEnew216d
Disclosure
CVE-2026-29065 http://changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows … https://www.cve.org/CVERecord?id=CVE-2026-29065
Post summary
The statement announces a Zip Slip flaw in ChangeDetection.io (CVE‑2026‑29065) affecting versions before 0.54.4, but does not provide proof‑of‑concepts, exploit code, active exploitation evidence, or patch information.
00000128
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds216d
Disclosure
CVE-2026-29065 Zip Slip Vulnerability in http://changedetection.io Prior to Version 0.54.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29065
Post summary
A Zip Slip vulnerability (CVE‑2026‑29065) is reported for changedetection.io versions prior to 0.54.4, with limited details and no PoC or exploit information provided.
0000041
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	webtechnologies	changedetection	-	-	-

Explore more

Back to dashboard webtechnologies CVEs changedetection vulnerabilities

What researchers are saying

CVE-2026-29065

PikaPods - Open Source Hosting[verified]@PikaPodsPatch

The tweet announces a critical security update for changedetection.io v0.54.4 that fixes CVE‑2026‑29038 and CVE‑2026‑29065, addressing XSS and file‑read vulnerabilities.

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2026-29065 as a Zip Slip vulnerability in Changedetection.io before version 0.54.4, noting its CVSS score and severity but offering no evidence of exploitation or mitigation.

CVE@CVEnewDisclosure

The statement announces a Zip Slip flaw in ChangeDetection.io (CVE‑2026‑29065) affecting versions before 0.54.4, but does not provide proof‑of‑concepts, exploit code, active exploitation evidence, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A Zip Slip vulnerability (CVE‑2026‑29065) is reported for changedetection.io versions prior to 0.54.4, with limited details and no PoC or exploit information provided.