CVE-2026-29065: Zip Slip Vulnerability in changedetection.io Backup Restore Functionality
Summary
CVE-2026-29065: changedetection.io has Zip Slip vulnerability in the backup restore functionality. Affects changedetection-io versions < 0.54.4. Fixed in 0.54.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
changedetection.io is an open-source application designed to monitor changes on web pages. It provides users with the ability to track updates and modifications, making it a valuable tool for developers and content managers. However, the application has a critical vulnerability in its backup restore functionality, which allows for arbitrary file overwrites through a Zip Slip attack, potentially compromising sensitive data.
Vulnerability Detail
The Zip Slip vulnerability arises from the application's use of the zipfile.extractall() method without proper validation of entry paths in uploaded ZIP archives. This oversight allows attackers to exploit path traversal sequences (e.g., ../) to extract files outside the intended directory. As a result, malicious users can overwrite critical files, leading to session forgery, authentication bypass, and unauthorized changes to application settings.
How To Fix
Latest published version: 0.60.9 as of 22 Oct 2026
pip install --upgrade "changedetection-io==0.60.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.54.4
This is the first release that contains the fix.
pip install --upgrade "changedetection-io==0.54.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the backup restore functionality until the package is updated. Additionally, validate ZIP file contents before extraction to prevent path traversal attacks.
Conclusion
The Zip Slip vulnerability in changedetection.io poses significant risks due to its ability to allow arbitrary file overwrites through path traversal in ZIP archives. Users are strongly advised to update to the latest version of the package to protect their applications from potential exploitation.
See every vulnerability recorded for changedetection-io →
FAQ
A Zip Slip vulnerability allows attackers to exploit path traversal sequences in ZIP files, enabling them to extract files outside the intended directory, potentially overwriting critical files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring sign-up.
The impacts include session forgery, authentication bypass, and unauthorized modifications to application settings, which can compromise the security and integrity of the application.
Yes, a patch is available in version 0.54.4 of changedetection.io. Users should upgrade to this version or later to mitigate the vulnerability.
If immediate updates are not possible, refrain from using the backup restore functionality and validate ZIP file contents before extraction as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for changedetection-io.
