ChangeDetection.io before version 0.54.7 contains a protection bypass vulnerability in its SafeXPath3Parser implementation. The parser's incomplete blocklist of dangerous XPath 3.0/3.1 functions, such as json-doc(), allows attackers to exploit these unblocked functions to read arbitrary local files on the system. This vulnerability is classified under CWE-184, reflecting an incomplete list of disallowed inputs that leads to unauthorized local file access. The CVSS 4.0 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

An attacker with network access and low privileges can exploit this vulnerability without user interaction to read arbitrary local files on the affected system. This can lead to unauthorized disclosure of sensitive information stored locally. The vulnerability does not affect integrity or availability but has a high confidentiality impact.

A fix is available in ChangeDetection.io version 0.54.7 and later. Users should upgrade to version 0.54.7 or newer to remediate this vulnerability. There is no vendor advisory provided here, so patch status is based on the version information given. Until patched, avoid exposing vulnerable versions to untrusted networks or users.