CVE-2026-35000

Medium

Description

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

SeverityMedium

CVSS6.5

Exploit probability—

ProductWebtechnologies Changedetection

PublishedApr 1, 2026

First seenApr 1, 2026

Weakness typeCWE-184CWE-184

How to fix

Update

webtechnologies changedetection0.54.7 or later
changedetection-io0.54.7 or later

Patches

github.com/dgtlmoon/changedetection.io/commit/dadc804567a51f803cd6715f7885c11a247915f6

Vendor advisories

github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7

Affected products

Product	Affected versions	Fixed in
webtechnologies changedetection	v < 0.54.7	0.54.7
changedetection-ioPyPI	v < 0.54.7	0.54.7

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.