# CVE-2026-29065: changedetection.io Zip Slip in backup restore

Source: https://junglewise.ai/threats/cve-2026-29065-changedetection-io-zip-slip-in-backup-restore  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-29065 · Severity: medium · CVSS 4 · Published 2026-03-06

changedetection.io is an open-source application that monitors websites for changes and backs up configuration data. A path traversal vulnerability in the backup restore functionality allows attackers to upload a specially crafted ZIP file that extracts files outside the intended directory, potentially overwriting sensitive application settings, disabling authentication, or injecting malicious watch configurations. An attacker with access to the restore feature can completely compromise the application without needing elevated privileges.

Technologies: [changedetection.io (PyPI)](https://junglewise.ai/threats/technologies/changedetection-io). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-29065 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29065 being exploited in the wild.

**How severe is CVE-2026-29065?** Medium severity, with a CVSS score of 4, published 6 March 2026.

**Which products and versions are affected?** changedetection.io (PyPI) ECOSYSTEM:introduced=0,fixed=0.54.4.

**Is there a fix for CVE-2026-29065?** Yes. changedetection.io (PyPI): upgrade to 0.54.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29065 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-29065?** Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- changedetection.io (PyPI): upgrade to 0.54.4 or later

  ```sh
  pip install "changedetection.io>=0.54.4"
  ```


## Technical details

The vulnerability is a Zip Slip path traversal flaw (CWE-22) in the backup restore functionality. The application uses Python's `zipfile.extractall()` without validating entry paths, allowing ZIP archives containing `../` sequences to escape the intended extraction directory. An attacker can craft a malicious ZIP file with entries like `../secret.txt` or `../changedetection.json` that, when extracted, overwrite critical application files. No authentication is required to exploit this vulnerability—attackers need only network access to the `/backups/restore` endpoint. Successful exploitation enables disabling application passwords, injecting backdoor watches, or forging authentication sessions. The vulnerability is fixed in version 0.54.4; all versions through 0.54.3 are affected.

## Affected products

- changedetection.io changedetection.io < 0.54.4

## Identifiers

- CVE-2026-29065
- GHSA-25g8-2mcf-fcx9
- PYSEC-2026-2129

## Timeline

- 2026-03-04: disclosed
- 2026-03-04: patched: Fixed in version 0.54.4

## References

- [https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9](https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9)

## Related threats

- [dgtlmoon changedetection.io path traversal in static content route](https://junglewise.ai/threats/cve-2026-25527-dgtlmoon-changedetection-io-path-traversal-in-static-content)
- [PYSEC-2026-1241 - ChangeDetection.io XSS in watch overview](https://junglewise.ai/threats/cve-2025-52558-changedetection-io-xss-in-watch-overview)
- [PYSEC-2026-1242 - changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal](https://junglewise.ai/threats/cve-2024-56509-changedetection-io-vulnerable-to-improper-input-validation)
- [PYSEC-2026-1239 - changedetection.io path traversal using file URI scheme without supplying hostname](https://junglewise.ai/threats/cve-2024-51998-changedetection-io-path-traversal-using-file-uri-scheme-without)
- [PYSEC-2026-1240 - changedetection.io Path Traversal](https://junglewise.ai/threats/cve-2024-51483-changedetection-io-path-traversal)