changedetection.io 0.54.9 and earlier parse XML input without disabling external entity resolution, exposing the application to XML External Entity attacks that can cause the application to read local files or fetch network resources. This flaw is consistent with CWE-611 and may result in disclosure of sensitive information without any additional exploitation steps.

The affected product is changedetection.io from vendor dgtlmoon, all releases 0.54.9 and earlier. Installations running these versions remain vulnerable until updated.

The CVSS score of 8.2 classifies this flaw as high severity. EPSS information is not available, so the probability of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the defect by providing crafted XML to the xpath_filter feature, which the application unconditionally processes. Successful exploitation requires only that the application accept user‑supplied XML, making this a realistic threat for deployments that expose the feed parser to untrusted content.