https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:49:16.173425+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-270548 EUVD-2026-270548 2026-10-02T17:49:16.572893+00:00 EUVD-2026-270548 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27696 fkie_cve-2026-27696 2026-10-02T17:49:16.572932+00:00

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs. The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services. Version 0.54.1 contains a fix for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-3c45-4pj5-ch7m GHSA-3c45-4pj5-ch7m — changedetection.io is Vulnerable to SSRF via Watch URLs 2026-10-02T17:49:16.572973+00:00

Affected: PyPI: changedetection.io

## Summary

Changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs such as:

- `http://169.254.169.254` - `http://10.0.0.1/` - `http://127.0.0.1/`

The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services.

This is particularly severe because:

- The fetched content is stored and viewable - this is not a blind SSRF - Watches are fetched periodically - creating a persistent SSRF that continuously accesses internal resources - By default, no password is set - the web UI is accessible without authentication - Self-hosted deployments typically run on cloud infrastructure where `169.254.169.254` returns real IAM credentials

---

## Details

The URL validation function `is_safe_valid_url()` in `changedetectionio/validate_url.py` (lines 60–122) validates the URL protocol (http/https/ftp) and format using the `validators` library, but does not perform any DNS resolution or IP address validation:

```python # changedetectionio/validate_url.py:60-122 @lru_cache(maxsize=1000) def is_safe_valid_url(test_url):

safe_protocol_regex = '^(http|https|ftp):'…

 https://cve.radiocsirt.org/vuln/pysec-2026-2126 PYSEC-2026-2126 2026-10-02T17:49:16.573059+00:00

Affected: PyPI: changedetection-io

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs. The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services. Version 0.54.1 contains a fix for the issue.