PT-2026-23090 · Unknown · Elementpath+1

Dhiyaneshgeek + 1 · Published 2026-03-04 · Updated 2026-03-11 · CVE-2026-29039

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.54.4

Description The changedetection.io application allows users to specify XPath expressions as content filters via the include filters field. These XPath expressions are processed using the elementpath library, which implements XPath 3.0/3.1 specifications. XPath 3.0 includes the unparsed-text() function, which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. The vulnerable code resides in the html tools.py file, specifically within the xpath filter() function (lines 187-220). The application's validation in forms.py only checks for syntactical validity of the XPath expression and does not prevent the use of dangerous functions like unparsed-text(). An attacker can exploit this by setting the include filters field to an XPath expression that utilizes unparsed-text() to read arbitrary files, such as /etc/passwd.

Recommendations Update to changedetection.io version 0.54.4 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-29039

GHSA-6FMW-82M7-JQ6P

Affected Products

Changedetection.Io

Elementpath

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29039.json · Exploit
• https://github.com/dgtlmoon/changedetection.io/commit/417d57e5749441e4be9acc4010369bded805d66f · Patch
• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6fmw-82m7-jq6p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29039 · Security Note
• https://osv.dev/vulnerability/GHSA-6fmw-82m7-jq6p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29039 · Vendor Advisory
• https://github.com/dgtlmoon/changedetection.io · Note
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4 · Note
• https://twitter.com/CVEnew/status/2029975553680494602 · Twitter Post
• https://t.me/CVEtracker/46572 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029914856434926044 · Twitter Post
• https://twitter.com/cracbot/status/2031686861509497267 · Twitter Post