CVE-2026-43891

{
  "id": "CVE-2026-43891",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T18:17:28.493",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and  returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1."
    },
    {
      "lang": "es",
      "value": "changedetection.io es una herramienta gratuita de código abierto para la detección de cambios en páginas web. Antes de la versión 0.55.1, la vulnerabilidad es causada por confiar en rutas de instantáneas controladas por el atacante restauradas desde archivos de copia de seguridad. El flujo vulnerable comienza en la lógica de restauración de copias de seguridad. Cuando se restaura un ZIP de copia de seguridad, la aplicación extrae el archivo y copia cada directorio UUID de vigilancia restaurado directamente en el almacén de datos en vivo usando shutil.copytree(entry.path, dst_dir). Esto preserva archivos controlados por el atacante dentro del directorio de vigilancia restaurado, incluyendo history.txt. Después de la restauración, la aplicación analiza history.txt en la propiedad de historial de vigilancia y devuelve el contenido del archivo local objetivo. Esta vulnerabilidad está corregida en la versión 0.55.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "dgtlmoon",
          "product": "changedetection.io",
          "versions": [
            {
              "version": "< 0.55.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T14:36:12.119506Z",
          "id": "CVE-2026-43891",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.55.1",
              "matchCriteriaId": "9ABB97F7-527C-49E5-9977-06AE0C451652"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8757-69j2-hx56",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-w6p7-2fxx-4f44",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Not Applicable",
        "Vendor Advisory"
      ]
    }
  ]
}