The vulnerability in changedetection.io (CVE-2026-43891) arises from trusting attacker-controlled snapshot paths during backup restoration. When a backup ZIP is restored, the application extracts and copies each watch UUID directory directly into the live datastore using shutil.copytree, preserving attacker-controlled files such as history.txt. Subsequently, the application parses history.txt and returns its contents, allowing an attacker to control which local file's content is exposed. This is classified under CWE-73 (External Control of File Name or Path). The issue is resolved in version 0.55.1.

An attacker can exploit this vulnerability to cause the application to return contents of arbitrary local files by manipulating the backup restore process. This results in unauthorized disclosure of sensitive local files. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

This vulnerability is fixed in changedetection.io version 0.55.1. Users should upgrade to version 0.55.1 or later to remediate this issue. Since no official patch link or advisory is provided, verify the upgrade availability from the vendor's official sources. Until upgraded, avoid restoring backups from untrusted sources to prevent exploitation.