CVE-2026-41895 Details
Description
changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).
A vulnerability allowing XML External Entity (XXE) injection has been identified in changedetection.io versions through 0.54.9. The issue arises in the 'xpath_filter()' function, which processes XML/RSS content without properly securing external entity resolution. This flaw allows untrusted XML to be parsed in a way that could expose sensitive local files through entity expansion, depending on the runtime environment.
Users can address this vulnerability by hardening the XML parser settings to disable entity resolution, DTD loading, and network access. It is also recommended to reject DOCTYPE or entity declarations in untrusted XML unless DTD features are needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-v7cp-2cx9-x793 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| webtechnologies changedetection | <= 0.54.9 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | New CVE Received | [email protected] |