TI-2026-63664 Aliases CVE-2026-95656 GHSA-xp5x-xjjr-fw2g

dgtlmoon changedetection.io Preview Endpoint init.py add_watch_ui_snapshot server-side request forgery

HIGH 70CWE-918Published 2026-09-22 · Updated 2026-09-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.60.1 is able to resolve this issue. The patch is named 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. The affected component should be upgraded. Was fixed upstream.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00511 43rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed changedetection.io (dgtlmoon): 0.60.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
dgtlmoon	changedetection.io	50389b07	0.60.1	Patch available	CNA

changedetection.io Vendordgtlmoon Affected 50389b07 Fixed in 0.60.1 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dgtlmoon:changedetection.io::::::::	—	—	—

cpe:2.3:a:dgtlmoon:changedetection.io:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA changedetection.io (dgtlmoon) Fixed in 0.60.1

Timeline

2026-10-02 Threatist record created from CVE-2026-95656
2026-10-03 Alias added: GHSA-xp5x-xjjr-fw2g

References

Exploit 1

https://github.com/herantong/cve/blob/main/changedetection.io_ssrf-preview-endpoint_CWE-918

Patch 2

Other 1

https://github.com/dgtlmoon/changedetection.io/

TI-2024-21533 Server Side Template Injection in Jinja2 allows Remote Command Execution CVSS 3.1CRITICAL 10.0
TI-2026-27619 changedetection.io has an Authentication Bypass via Decorator Ordering CVSS 3.1CRITICAL 9.8
TI-2026-23210 changedetection.io: Zip Slip vulnerability in the backup restore functionality CVSS 4.0HIGH 8.8
TI-2026-62554 changedetection.io through 0.60.6 SSRF via browser-step Goto URL CVSS 4.0HIGH 8.7
TI-2026-22073 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs CVSS 3.1HIGH 8.6
TI-2024-37396 changedetection.io has Improper Input Validation Leading to LFR/Path Traversal CVSS 3.1HIGH 8.6

See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences