CVE-2026-27696
HIGH
GHSA-3c45-4pj5-ch7m
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4Tags
Description
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs. The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI - enabling full data exfiltration from internal services. Version 0.54.1 contains a fix for the issue.
Analysis
changedetection.io is a free open source web page change detection tool. [CVSS 8.6 HIGH]
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all changedetection.io instances in your environment and assess current version/patch status. Within 7 days: Apply the available vendor patch to all identified instances and validate successful deployment. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today