CVE-2026-41895 changedetection.io: XXE vulnerability in the changedetection.io project
An attacker can exploit XML parsing flaws in changedetection.io to read sensitive files or cause denial of service via external entity injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41895?
CVE-2026-41895 is a high-severity vulnerability in dgtlmoon changedetection.io, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).
Weakness: CWE-611
Which versions are affected by CVE-2026-41895?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions to 0.54.9 | None |
changedetection-io PyPI | All versions to 0.54.9 | None |
changedetection-io PyPI | All versions | 0.54.10 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2026-41895?
Upgrade to a fixed version.
Is CVE-2026-41895 being exploited?
There is no known exploitation of CVE-2026-41895 in the wild and no public exploit code.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Sources
Also known as GHSA-v7cp-2cx9-x793, PYSEC-2026-29.