VulnSocial

CVE-2026-35000Disclosure(webtechnologies / changedetection)

LOWCVSS 7.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch webtechnologies changedetection systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

webtechnologies CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-184

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • changedetection

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
webtechnologies
Products
changedetection

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-02: 2Patch / Workaround · 2026-04-02: 1Technical Details · 2026-04-02: 204-02
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets3 URLs
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-35000 http://ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary l… https://www.cve.org/CVERecord?id=CVE-2026-35000 ----- Traducción: CVE-2026-3500… http://infoflow.cloud`

    Post summary

    CVE-2026-35000 is a protection bypass vulnerability discovered in ChangeDetection.io prior to version 0.54.7, enabling arbitrary file reads via the SafeXPath3Parser.

    0000040
    65 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-35000 http://ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary l… https://www.cve.org/CVERecord?id=CVE-2026-35000

    Post summary

    CVE-2026-35000 is a protection‑bypass vulnerability in ChangeDetection.io’s SafeXPath3Parser affecting releases before 0.54.7; upgrading to 0.54.7 or newer should remediate the issue.

    00000165
    56.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appwebtechnologieschangedetection---

Explore more

Back to dashboardwebtechnologies CVEschangedetection vulnerabilities