CVE-2026-95656
Received Received - Intake

Server-Side Request Forgery in ChangeDetection.io

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulDB

Description
A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.60.1 is able to resolve this issue. The patch is named 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. The affected component should be upgraded. Was fixed upstream.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95656
EUVD
EUVD-2026-84576

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dgtlmoon changedetection.io 0.60.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in the changedetection.io tool. It exists in the Preview Endpoint feature, specifically in the function add_watch_ui_snapshot. An attacker can manipulate the 'url' argument to force the server to make unauthorized requests to internal or external systems. The vulnerability was fixed in version 0.60.1.

Detection Guidance

This vulnerability involves server-side request forgery (SSRF) in the Preview Endpoint of changedetection.io. To detect it, monitor network traffic for unexpected outbound requests from the application, especially to internal or sensitive systems. Check logs for unusual URL fetches or snapshot requests. Ensure the application is running the patched version 0.60.1 or later.

Impact Analysis

This SSRF vulnerability could allow an attacker to access internal services, bypass firewalls, or interact with other systems on your network. It may lead to data leakage, unauthorized actions, or further exploitation of internal resources. Users running affected versions should upgrade immediately.

Compliance Impact

SSRF vulnerabilities can lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed due to this flaw. Users should assess their exposure and apply patches promptly.

Mitigation Strategies

Immediately upgrade changedetection.io to version 0.60.1 or later to apply the patch. If upgrading is not possible, disable the Preview Endpoint feature or restrict network access to prevent SSRF attacks. Review and monitor network configurations to block unauthorized outbound requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95656. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart