Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
CVE-2026-47260

7.7HIGH

Key Information:

Vendor

Koel

Status
Koel
Vendor
CVE Published:
12 June 2026

What is CVE-2026-47260?

Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.

Affected Version(s)

koel < 9.3.5

References

https://github.com/koel/koel/security/advisories/GHSA-7j2...
x_refsource_CONFIRM
https://github.com/koel/koel/commit/8708f077efd7d8a332b32...
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.