CVE-2026-43891 Details
Description
changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.
A vulnerability allowing arbitrary local file read has been identified in changedetection.io, prior to version 0.55.1. This issue arises from the application's backup restore process, which improperly trusts snapshot paths controlled by attackers. When a backup ZIP file is restored, the application extracts the archive and directly copies the restored watch UUID directories into the live datastore. This process preserves any attacker-controlled files, such as 'history.txt', within the restored watch directory. After the restoration, the application parses 'history.txt' and returns the contents of the specified local file, effectively allowing access to sensitive system files or application data.
Users should update to changedetection.io version 0.55.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44 | CISA-ADP | ExploitMitigationNot ApplicableVendor Advisory |
| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8757-69j2-hx56 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| webtechnologies changedetection | < 0.55.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |