A zip slip flaw in the backup restore function of changedetection.io enables an attacker to craft a ZIP archive that extracts files to arbitrary locations on the server, resulting in overwriting existing files. The vulnerability is associated with CWE‑22 path traversal. Based on the description, it is inferred that overwriting executable or configuration files could lead to remote code execution or disruption of service, although the CVE does not explicitly state these outcomes.

The affected product is dgtlmoon's changedetection.io, an open‑source web page change detection service. All releases prior to version 0.54.4 are vulnerable. The security advisory indicates that patching to version 0.54.4 or later resolves the issue.

The CVSS score of 8.8 classifies the flaw as high severity, and the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The risk is highest when the backup restore endpoint is exposed to users without strong authentication or authorization controls. Although the vulnerability is not listed in CISA's KEV catalog, the potential for critical file overwrite warrants swift remediation. The likely attack vector is remote: an attacker uploads a malicious ZIP during a restoration operation and triggers the path traversal when the archive is unpacked.