CVE-2026-29039 Details

A vulnerability in changedetection.io prior to version 0.54.4 allows users to execute arbitrary file reads by exploiting the XPath unparsed-text() function. The application fails to validate or sanitize XPath expressions, enabling access to any file readable by the application process. This issue arises because the elementpath library, which processes the XPath expressions, implements XPath 3.0/3.1 specifications that include functions capable of reading files from the filesystem. The vulnerability can be reproduced by creating a watch with a crafted XPath expression that uses the unparsed-text() function to request a file, such as /etc/passwd. The file contents are then returned through the application's normal data processing pipeline, where they can be viewed in the user interface.

Users can update to changedetection.io version 0.54.4 or later, where this vulnerability has been patched.