Security Resilience

CVE-2026-35000

Webtechnologies Changedetection ≤ 0.54.7

Public PoC
Published
01 April 2026
Modified
14 July 2026
Patch / advisory
View advisory
CVSS Score v4 7.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0047 40th percentile
Risk Priority 36 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-35000 is a high-severity Incomplete List of Disallowed Inputs (CWE-184) vulnerability in Webtechnologies Changedetection. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique SVG Smuggling (T1027.017); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete…

more

blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

CWE(s)
CWE-184

Related Threats

MITRE ATT&CK Enterprise Techniques

T1027.017 SVG Smuggling Stealth
Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.
attack.mitre.org →
T1218.005 Mshta Stealth
Adversaries may abuse mshta.
attack.mitre.org →
T1218.008 Odbcconf Stealth
Adversaries may abuse odbcconf.
attack.mitre.org →
T1553 Subvert Trust Controls Defense Impairment
Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.
attack.mitre.org →
T1566.001 Spearphishing Attachment Initial Access
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-43891Same product: Webtechnologies Changedetection
CVE-2026-25527Same product: Webtechnologies Changedetection
CVE-2026-29065Same product: Webtechnologies Changedetection
CVE-2026-29038Same product: Webtechnologies Changedetection
CVE-2026-27645Same product: Webtechnologies Changedetection
CVE-2023-24769Same product: Webtechnologies Changedetection
CVE-2026-29039Same product: Webtechnologies Changedetection
CVE-2026-27696Same product: Webtechnologies Changedetection
CVE-2026-41895Same product: Webtechnologies Changedetection
CVE-2024-23329Same product: Webtechnologies Changedetection

Affected Assets

webtechnologies
changedetection
≤ 0.54.7

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 2 hardening rules · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V3.5.2
  • V4.4.2
  • V16.2.5

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

SI-10 requires validity checks on inputs, which structurally replaces incomplete deny-lists with complete allow-list or sanitization logic.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly require complete, positive input validation instead of incomplete denylists.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can discover missing input checks, but does not prevent the weakness during development.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly require exhaustive allow-lists or complete deny-lists for inputs, addressing the root cause of incomplete disallowed-input lists.

References