https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:11:22.324537+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-275062 EUVD-2026-275062 2026-10-03T06:11:22.424685+00:00 EUVD-2026-275062 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29065 fkie_cve-2026-29065 2026-10-03T06:11:22.424723+00:00

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.

 https://cve.radiocsirt.org/vuln/ghsa-25g8-2mcf-fcx9 GHSA-25g8-2mcf-fcx9 — changedetection.io has Zip Slip vulnerability in the backup restore functionality 2026-10-03T06:11:22.424762+00:00

Affected: PyPI: changedetection.io

### Summary A Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives.

### Details

A Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. The application uses zipfile.extractall() without validating entry paths, allowing ../ sequences to escape the extraction directory.

Vulnerable Code (lines 50-53): ``` def restore_backup(self, filename): with zipfile.ZipFile(filename, 'r') as zip_ref: # VULNERABLE: No path validation before extraction zip_ref.extractall(self.datastore_path) ``` The extractall() function preserves the relative paths stored within the ZIP archive. When a malicious ZIP contains entries with ../ path traversal sequences, these files are extracted outside the intended directory.

| Path in ZIP | Target File | Impact | | --- | --- | --- | | ../secret.txt | Flask secret key | Session forgery, auth bypass | | ../changedetection.json | App settings | Disable password, inject backdoor | | ../url-watches.json | Watch index | Inject malicious watches | | ../{uuid}/watch.json | Watch config | Modify any watch |

Attacker uploads ZIP via the backup restore functionality at /backups/restore Application extracts files without validation, writing attacker content to sensitive locations

### PoC

Step 1: Create Malicious ZIP ``` import zipfile import json

with zipfile.ZipFile("zipslip.zip",…

 https://cve.radiocsirt.org/vuln/pysec-2026-2129 PYSEC-2026-2129 2026-10-03T06:11:22.424817+00:00

Affected: PyPI: changedetection-io

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality allows arbitrary file overwrite via path traversal in uploaded ZIP archives. This issue has been patched in version 0.54.4.