Is CVE-2026-43891 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43891 being exploited in the wild.

How severe is CVE-2026-43891?

High severity, with a CVSS score of 7.5, published 12 May 2026.

Which products and versions are affected?

changedetection.io (PyPI) <= 0.54.10, ECOSYSTEM:introduced=0,fixed=0.55.1.

Is there a fix for CVE-2026-43891?

Yes. changedetection.io (PyPI): upgrade to 0.55.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43891 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-43891?

Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43891: dgtlmoon changedetection.io Arbitrary Local File Read via Backup Restore

Q: Is there a fix for CVE-2026-43891?

Yes. changedetection.io (PyPI): upgrade to 0.55.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-43891 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-43891?

Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43891 · Severity: high · CVSS 7.5 · Published 2026-05-12

changedetection.io is a tool used to monitor websites for changes. A security flaw allows an attacker to read sensitive files from the server's local storage by uploading a specially crafted backup file. This could lead to the exposure of system passwords, configuration files, and private application data.

Technologies: changedetection.io (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-43891 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43891 being exploited in the wild.
How severe is CVE-2026-43891?: High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?: changedetection.io (PyPI) <= 0.54.10, ECOSYSTEM:introduced=0,fixed=0.55.1.
Is there a fix for CVE-2026-43891?: Yes. changedetection.io (PyPI): upgrade to 0.55.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43891 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43891?: Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

changedetection.io (PyPI): upgrade to 0.55.1 or later
```
pip install "changedetection.io>=0.55.1"
```

Technical details

The vulnerability exists in the backup restore logic of changedetection.io. When a backup ZIP is restored, the application extracts and copies watch directories into the live datastore without validating the contents of 'history.txt'. The application's path resolution logic in 'model/Watch.py' fails to enforce a trust boundary; if a history entry contains path separators and the referenced file exists, it is accepted as a valid snapshot path. An attacker can provide a crafted backup containing absolute paths (e.g., /etc/passwd). When a user views the 'Preview' or accesses the history API for that watch, the application performs a direct file read on the attacker-specified path and returns the content. This has been patched in version 0.55.1.

Affected products

dgtlmoon changedetection.io <= 0.54.10

Identifiers

CVE-2026-43891
GHSA-8757-69j2-hx56
PYSEC-2026-30

Timeline

2026-04-27: advisory: GitHub Advisory published
2026-05-05: disclosed
0.55.1: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.