CVE-2026-29039

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions are processed using the elementpath library which implements XPath 3.0/3.1 specification. XPath 3.0 includes the unparsed-text() function which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. This issue has been patched in version 0.54.4.

• CWE-94

• https://github.com/dgtlmoon/changedetection.io/commit/417d57e5749441e4be9acc4010369bded805d66fPatch
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4Product, Release Notes
• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6fmw-82m7-jq6pExploit, Vendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29032Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29033Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29034Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29035CivetWeb (commit 4a4f0c95) contains a heap and stack buffer …6.5
• CVE-2026-29036cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-r…7.5
• CVE-2026-29038changedetection.io is a free open source web page change det…6.1
• CVE-2026-2904A vulnerability was determined in UTT HiPER 810G 1.7.7-17111…8.8
• CVE-2026-29041Chamilo is a learning management system. Prior to version 1.…8.8
• CVE-2026-29042Nuclio is a "Serverless" framework for Real-Time Events and …9.8
• CVE-2026-29043HDF5 is software for managing data. In 1.14.1-2 and earlier,…5.5
• CVE-2026-29044EVerest is an EV charging software stack. Prior to version 2…6.5
• CVE-2026-29045Hono is a Web application framework that provides support fo…9.8