The vulnerability resides in changedetection.io's processing of XPath expressions supplied via the include_filters field. The elementpath library implements XPath 3.0/3.1 and supports the unparsed-text() function, which can read any file on the filesystem. Because the application fails to validate or sanitize the XPath expression, an attacker can craft an expression that invokes unparsed-text() and obtain the contents of any file the application process can access.

All installations of dgtlmoon:changedetection.io built before version 0.54.4 are affected. The vulnerable functionality is the include_filters configuration that accepts arbitrary XPath expressions.

CVSS 8.8 indicates a high severity of arbitrary file access. EPSS score is lower than 1% suggesting the likelihood of exploitation is low but not zero. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves an attacker submitting a malicious XPath expression via the include_filters field, either through a public-facing API or an exposed configuration mechanism. No authentication or privileged user rights are required, assuming the application accepts unauthenticated filter input. The attack would allow the attacker to read any file readable by the application process, potentially exposing sensitive configuration, logs, or credentials.