Medium severity6.5NVD Advisory· Published Apr 1, 2026· Updated Apr 21, 2026

CVE-2026-35000

Description

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

Affected products

Webtechnologies/Changedetection
cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*
Range: <0.54.7

Patches

dadc804567a5

https://github.com/dgtlmoon/changedetection.iovia nvd-ref

commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/dgtlmoon/changedetection.io/commit/dadc804567a51f803cd6715f7885c11a247915f6nvdPatch
www.vulncheck.com/advisories/changedetection-io-safexpath3parser-bypass-arbitrary-file-readnvdPatchThird Party Advisory
github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000