CVE-2026-29065 is a critical (CVSS 9.1) Zip Slip vulnerability in changedetection.io before version 0.54.4. The backup restore feature extracts uploaded ZIP archives without checking entry paths, so files can be written outside the intended folder. Upgrade to 0.54.4 or later.
What's affected
The GitHub advisory lists the PyPI package changedetection.io at 0.54.3 and earlier. The patched version is 0.54.4.
The flaw is in the backup restore code, which the advisory says used zipfile.extractall() without validating entry paths. The feature sits behind the restore endpoint of the web interface.
How to check if you're exposed
Check the installed version:
pip show changedetection.io
For Docker, check the image tag you run. Anything at 0.54.3 or earlier needs the update. Also check whether the web interface is reachable from outside your network and whether it has a password set.
What to do now
- Upgrade to 0.54.4 or later and restart the service.
- Put the interface behind a VPN or an authenticating reverse proxy, and set a password.
- Do not restore backup ZIP files from sources you do not trust.
- Run the service as a limited user with write access only to its data directory.
- If it was exposed, review the data directory for unexpected changes to settings and watch definitions, and rotate the application's secret key.
Why it matters
This is path traversal, CWE-22, in the form known as Zip Slip. A ZIP entry can carry a name with parent-directory sequences. Extraction code that joins that name to a target folder without checking where it ends up will write the file outside the folder.
The advisory lists what an attacker could overwrite: the Flask secret key, the application settings, the watch index and individual watch configurations. Replacing the secret key allows forged sessions, and replacing the settings can remove password protection. So an upload feature becomes a way to take over the application.
The fix pattern is to resolve each entry's final path and refuse anything that leaves the target directory. The record does not mark the CVE as exploited in the wild.
Quick check
Does the attacker need to log in?
The CVSS vector in the record lists no privileges required. Many installations run without a password, so exposure depends on how you deploy it.
Sources
Last reviewed: 19 October 2026.
