CVE-2026-41895 is an XXE vulnerability in changedetection.io (<= 0.54.9) where the xpath_filter() function switches to XML mode and creates an XML parser without disabling external entity resolution, external DTD loading, or network-backed entity lookup. The parser then processes untrusted XML bytes directly, allowing an attacker to exploit the improper restriction of XML external entity references (CWE-611). The CVSS 4.0 score is 8.2, indicating high severity with network attack vector, high impact on confidentiality, and requiring high attack complexity and privileges to exploit.

An attacker can exploit this vulnerability by supplying crafted XML/RSS content to the affected changedetection.io versions, potentially leading to disclosure of sensitive information or other impacts related to XML external entity processing. The CVSS score of 8.2 reflects a high severity impact primarily on confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. Until a patch is available, avoid processing untrusted XML content or apply manual mitigations such as disabling external entity resolution in the XML parser if possible.