CVE-2026-35490

CVE-2026-35490 affects changedetection.io before 0.54.8. In Flask, the decorator order was wrong: @login_optionally_required applied before @blueprint.route(), causing the route to register the undecorated function and bypass authentication. The issue affects multiple routes across several bluepr...

CVE-2026-29065

CVE-2026-29065 affects changedetection.io; pre-0.54.4, the backup restore function is vulnerable to Zip Slip (path traversal) in ZIP archives, enabling arbitrary file overwrite outside the extraction directory. Impact is described as high confidentiality and integrity risk with network attacker a...

CVE-2026-29039

Changedetection.io prior to 0.54.4 is vulnerable to an Arbitrary File Read via XPath in include_filters, where unparsed-text() can read files accessible to the application. Affected component is the XPath-based content filter processing using the elementpath parser. Impact includes reading sensit...