Is CVE-2026-29065 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29065 being exploited in the wild.

How severe is CVE-2026-29065?

Medium severity, with a CVSS score of 4, published 6 March 2026.

Which products and versions are affected?

changedetection.io (PyPI) ECOSYSTEM:introduced=0,fixed=0.54.4.

Is there a fix for CVE-2026-29065?

Yes. changedetection.io (PyPI): upgrade to 0.54.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29065 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-29065?

Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29065: changedetection.io Zip Slip in backup restore

CVE-2026-29065 · Severity: medium · CVSS 4 · Published 2026-03-06

changedetection.io is an open-source application that monitors websites for changes and backs up configuration data. A path traversal vulnerability in the backup restore functionality allows attackers to upload a specially crafted ZIP file that extracts files outside the intended directory, potentially overwriting sensitive application settings, disabling authentication, or injecting malicious watch configurations. An attacker with access to the restore feature can completely compromise the application without needing elevated privileges.

Technologies: changedetection.io (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-29065 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29065 being exploited in the wild.
How severe is CVE-2026-29065?: Medium severity, with a CVSS score of 4, published 6 March 2026.
Which products and versions are affected?: changedetection.io (PyPI) ECOSYSTEM:introduced=0,fixed=0.54.4.
Is there a fix for CVE-2026-29065?: Yes. changedetection.io (PyPI): upgrade to 0.54.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29065 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-29065?: Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

changedetection.io (PyPI): upgrade to 0.54.4 or later
```
pip install "changedetection.io>=0.54.4"
```

Technical details

The vulnerability is a Zip Slip path traversal flaw (CWE-22) in the backup restore functionality. The application uses Python's `zipfile.extractall()` without validating entry paths, allowing ZIP archives containing `../` sequences to escape the intended extraction directory. An attacker can craft a malicious ZIP file with entries like `../secret.txt` or `../changedetection.json` that, when extracted, overwrite critical application files. No authentication is required to exploit this vulnerability—attackers need only network access to the `/backups/restore` endpoint. Successful exploitation enables disabling application passwords, injecting backdoor watches, or forging authentication sessions. The vulnerability is fixed in version 0.54.4; all versions through 0.54.3 are affected.

Affected products

changedetection.io changedetection.io < 0.54.4

Identifiers

CVE-2026-29065
GHSA-25g8-2mcf-fcx9
PYSEC-2026-2129

Timeline

2026-03-04: disclosed
2026-03-04: patched: Fixed in version 0.54.4

References

https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.