PT-2026-37163 · Unknown · Changedetection.Io

Published 2026-05-04 · Updated 2026-05-13 · CVE-2026-41895

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions changedetection.io versions 0.54.9 and earlier

Description The software contains an XML External Entity (XXE) issue where the xpath filter() function switches to XML mode for XML/RSS content and creates an etree.XMLParser(strip cdata=False) without disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly using etree.fromstring(). This can allow an attacker who controls a monitored XML/RSS response body to use an XPath include filter to trigger the parsing of external entity declarations, potentially leading to local file disclosure where sensitive files are exposed in watch output, diff history, and notification channels.

Recommendations For versions 0.54.9 and earlier, harden the XML parser construction by setting resolve entities=False, load dtd=False, and no network=True. As a temporary mitigation, avoid using XPath include filters on untrusted XML/RSS content.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-41895

GHSA-V7CP-2CX9-X793

PYSEC-2026-29

Affected Products

Changedetection.Io

References · 7

• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-v7cp-2cx9-x793 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v7cp-2cx9-x793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41895 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-29 · Vendor Advisory
• https://github.com/dgtlmoon/changedetection.io · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2026-29.yaml · Note
• https://t.me/cveNotify/163378 · Telegram Post