CVE-2026-35000: ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read

Vulnerability summary

CVE-2026-35000 is a high (CVSS 7.1) Incomplete List of Disallowed Inputs vulnerability in dgtlmoon changedetection.io. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.6% of scored vulnerabilities.

Timeline

1. 01-04-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

• CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.