CVE-2026-43891

Summary

changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extr

Severity

high

EPSS

0.4% (p27)

Also known as

GHSA-8757-69j2-hx56, PYSEC-2026-30

Published

2026-05-12

References

• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8757-69j2-hx56
• https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44
• https://github.com/advisories/GHSA-8757-69j2-hx56

Related advisories

• CVE-2026-35490 — critical · PyPI/changedetection-io
• CVE-2026-41895 — high · PyPI/changedetection-io
• CVE-2026-33981 — high · PyPI/changedetection-io
• CVE-2026-29065 — high · PyPI/changedetection-io
• CVE-2026-29039 — high · PyPI/changedetection-io
• CVE-2026-27696 — high · PyPI/changedetection-io
• CVE-2025-52558 — high · PyPI/changedetection-io
• CVE-2024-56509 — high · PyPI/changedetection-io

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity