PT-2026-23059 · Unknown+2 · Changedetection.Io+2

Neo-Ai-Engineer + 1 · Published 2026-03-04 · Updated 2026-03-11 · CVE-2026-29065

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.54.4

Description A Zip Slip vulnerability exists in the backup restore functionality, allowing arbitrary file overwrite via path traversal in uploaded ZIP archives. The application uses zipfile.extractall() without validating entry paths, enabling attackers to escape the extraction directory using '../' sequences. A malicious ZIP archive can contain entries crafted to overwrite sensitive files, such as the Flask secret key (/secret.txt), application settings (changedetection.json), and watch configurations (url-watches.json or watch.json within a UUID directory). The vulnerability is triggered by uploading a specially crafted ZIP archive via the backup restore functionality at the /backups/restore endpoint. The restore backup() function (lines 50-53) is vulnerable. Attackers can upload ZIP files containing malicious content, which is then written to sensitive locations on the system.

Recommendations Versions prior to 0.54.4 should be updated to version 0.54.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-29065

GHSA-25G8-2MCF-FCX9

Affected Products

Flask

Changedetection.Io

Zipfile

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29065.json · Exploit
• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9 · Vendor Advisory
• https://github.com/dgtlmoon/changedetection.io/commit/1d7d812eb0faab37042246e2fbce04f29bb1b3aa · Patch
• https://osv.dev/vulnerability/CVE-2026-29065 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-25g8-2mcf-fcx9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29065 · Security Note
• https://github.com/dgtlmoon/changedetection.io · Note
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4 · Note
• https://twitter.com/CVEnew/status/2029975552552227037 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029904616654029033 · Twitter Post
• https://twitter.com/cracbot/status/2031686866957914270 · Twitter Post
• https://twitter.com/PikaPods/status/2029178440578973758 · Twitter Post
• https://t.me/CVEtracker/46577 · Telegram Post