CVE-2026-35000 in changedetection.io
요약 (영어)
ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
책임이 있는
VulnCheck
예약하다
2026. 03. 31.
공개
2026. 04. 01.
상태
확인됨
엔트리
VulDB provides additional information and datapoints for this CVE:
| 아이디 | 취약성 | CWE | 악용 | 대책 | CVE |
|---|---|---|---|---|---|
| 354750 | dgtlmoon changedetection.io SafeXPath3Parser json-doc 권한 상승 | 184 | 정의되지 않음 | 공식 수정 | CVE-2026-35000 |