CVE-2026-92815highCWE-918

CVE-2026-92815: high-severity vulnerability in dgtlmoon changedetection.io

changedetection.io through 0.60.6 SSRF via browser-step Goto URL

Published · Updated

Follow this CVE+ Monitor changedetection.io

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.7epss 0.5%
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
dgtlmoon · changedetection.io
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — dgtlmoon changedetection.io

In the same product, most dangerous first.

CVE-2024-32651CRITICALServer Side Template Injection in Jinja2 allows Remote Command ExecutionEPSS 83.6%CVE-2024-51483MEDIUMchangedetection.io Path Traversal vulnerabilityEPSS 2.3%CVE-2024-34061MEDIUMReflected cross site scripting in changedetection.ioEPSS 1.3%CVE-2026-25527MEDIUMchangedetection.io vulnerable to unauthenticated static path traversalEPSS 1.0%CVE-2024-56509HIGHchangedetection.io has Improper Input Validation Leading to LFR/Path TraversalEPSS 0.7%CVE-2024-51998HIGHPath traversal using file URI scheme without supplying hostname in changedetection.ioEPSS 0.7%