CVE-2026-41895 is an XXE vulnerability in changedetection.io (<= 0.54.9) where the xpath_filter() function switches to XML mode and creates an XML parser without disabling external entity resolution, external DTD loading, or network-backed entity lookups. This allows untrusted XML input to be parsed with etree.fromstring(...) in a way that can be exploited to process malicious external entities. The vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference).

The vulnerability allows an attacker to supply crafted XML input that could lead to disclosure of internal files, server-side request forgery, or denial of service due to the processing of external entities. The CVSS 4.0 score of 8.2 indicates a high severity impact with network attack vector, high complexity, and no privileges or user interaction required. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted XML content with changedetection.io versions 0.54.9 and earlier or apply manual mitigations such as disabling external entity resolution in the XML parser if possible.