CVE-2026-41895: Webtechnologies Changedetection

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external entity resolution, external DTD loading, or network-backed entity lookup. The helper then parses untrusted XML bytes directly with etree.fromstring(...).

Affected products

• Webtechnologies Changedetection: up to and including 0.54.9

Published 2026-05-12. Last modified 2026-06-17.