CVE-2026-29039: changedetection.io Arbitrary File Read via XPath unparsed-text() Vulnerability
Summary
CVE-2026-29039: changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text(). Affects changedetection-io versions < 0.54.4. Fixed in 0.54.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
changedetection.io is an open-source application designed to monitor changes in web pages and notify users of updates. It allows users to specify content filters using XPath expressions, enabling fine-tuned monitoring of specific elements on a page. However, the application is vulnerable to an arbitrary file read due to improper validation of user-supplied XPath expressions, specifically allowing the use of the unparsed-text() function.
Vulnerability Detail
The vulnerability arises from the changedetection.io application allowing users to input XPath expressions without sufficient validation or sanitization. This oversight permits an attacker to exploit the unparsed-text() function, which can read arbitrary files from the filesystem. As a result, an attacker can access sensitive files, including configuration files, credentials, and even application source code, leading to potential data breaches and unauthorized access.
How To Fix
Latest published version: 0.60.9 as of 22 Oct 2026
pip install --upgrade "changedetection-io==0.60.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.54.4
This is the first release that contains the fix.
pip install --upgrade "changedetection-io==0.54.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using XPath expressions that include the unparsed-text() function until the package is updated. Additionally, consider implementing strict input validation to filter out potentially harmful functions.
Conclusion
The changedetection.io application is vulnerable to an arbitrary file read due to improper handling of XPath expressions. Users are strongly advised to update to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for changedetection-io →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker can read any file accessible to the application process, including sensitive configuration files, credentials, and application source code.
Yes, a patch is available in version 0.54.4 of the changedetection-io package. Users should upgrade to this version to mitigate the vulnerability.
If you cannot update the package immediately, avoid using XPath expressions that include the unparsed-text() function and implement strict input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for changedetection-io.
