Which versions of Changedetection Io are affected by CVE-2026-35000?

ChangeDetection.io versions before 0.54.7 contain a local file disclosure vulnerability that allows authenticated users to read sensitive files from the server by exploiting unblocked XPath…. A patch is available.

How to fix or mitigate CVE-2026-35000?

Within 24 hours: identify all instances of ChangeDetection.io in your environment and determine current versions. Within 7 days: upgrade all instances to version 0.54.7 or later. Within 30 days: conduct a log review to identify any suspicious XPath-based file read attempts by authenticated users and verify no unauthorized file access occurred.

Changedetection Io CVE-2026-35000

Q: What is the CVSS score of CVE-2026-35000?

CVE-2026-35000 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-18005 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-04-01 VulnCheck

GHSA-x3f8-2w95-hw4m

Information Disclosure Changedetection Io

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 21, 2026 - 00:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 00:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 01, 2026 - 19:00 euvd

EUVD-2026-18005

Analysis Generated

Apr 01, 2026 - 19:00 vuln.today

Patch released

Apr 01, 2026 - 19:00 nvd

Patch available

CVE Published

Apr 01, 2026 - 18:09 nvd

HIGH 7.1

DescriptionCVE.org

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

AnalysisAI

Arbitrary local file disclosure in ChangeDetection.io versions before 0.54.7 allows authenticated attackers to read sensitive files from the server filesystem by exploiting incomplete XPath function blocklist. The vulnerability stems from unblocked XPath 3.0/3.1 functions like json-doc() that bypass SafeXPath3Parser protections. EPSS score of 0.05% indicates low likelihood of widespread exploitation. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck with vendor patch released in version 0.54.7.

Technical ContextAI

ChangeDetection.io is a self-hosted web monitoring tool that tracks changes to websites. This vulnerability affects the SafeXPath3Parser component, which is designed to sanitize XPath expressions to prevent abuse. XPath 3.0 and 3.1 introduced file-access functions including json-doc(), unparsed-text(), and doc() that can read arbitrary files from the local filesystem when provided with file:// URIs or local paths. The parser's blocklist implementation is incomplete, failing to prevent all dangerous file-access primitives. CWE-184 (Incomplete List of Disallowed Inputs) directly describes this root cause - the security control uses a deny-list approach that omits critical functions. CPE cpe:2.3:a:dgtlmoon:changedetection.io identifies the affected product. The vulnerability requires authenticated access (CVSS PR:L), suggesting exploitation requires a valid user account on the ChangeDetection.io instance.

RemediationAI

Upgrade ChangeDetection.io to version 0.54.7 or later, which contains the vendor-released patch addressing the SafeXPath3Parser blocklist bypass (commit dadc804567a51f803cd6715f7885c11a247915f6). Administrators can verify their current version through the application interface or deployment configuration. If immediate patching is not feasible, implement compensating controls: restrict user account creation to trusted administrators only, audit existing user accounts and revoke access for untrusted users, run the ChangeDetection.io process with minimum required filesystem permissions using dedicated service accounts, employ mandatory access control (MAC) systems like SELinux or AppArmor to confine the application's file read capabilities to only necessary directories, and monitor application logs for suspicious XPath expressions containing file-access functions. Note that restricting filesystem permissions may interfere with legitimate application functionality if ChangeDetection.io requires broader file access for its monitoring features. Review the VulnCheck advisory at https://www.vulncheck.com/advisories/changedetection-io-safexpath3parser-bypass-arbitrary-file-read for additional technical context.