CVE-2026-29039

Name: CVE-2026-29039
Creator: NVD / NIST
Published: 2026-03-06T07:16:01.573+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 0.48%

Last modified Jun 17, 2026

CVE-2026-29039 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. EPSS estimates a 0.48% chance of exploitation in the next 30 days.

Description

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XPath expressions as content filters via the include_filters field. These XPath expressions are processed using the elementpath library which implements XPath 3.0/3.1 specification. XPath 3.0 includes the unparsed-text() function which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. This issue has been patched in version 0.54.4.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS 4.0

8.8/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.48%

38.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-94

Affected Software

Vendor	Product	Versions
Webtechnologies	Changedetection	< 0.54.4

References

https://github.com/dgtlmoon/changedetection.io/commit/417d57e5749441e4be9acc4010369bded805d66fPatch
https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4Product, Release Notes
https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6fmw-82m7-jq6pExploit, Vendor Advisory

Timeline

Published: Mar 6, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-29039?

How severe is CVE-2026-29039?

CVE-2026-29039 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.48% probability of exploitation in the next 30 days.

How do I fix CVE-2026-29039?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-29039?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST