CVE-2026-47260

Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.

• CWE-918

• https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a
• https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc
• https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4725Sandbox escape due to use-after-free in the Graphics: Canvas…10
• CVE-2026-47250mcp-server-kubernetes is a Model Context Protocol server for…6.1
• CVE-2026-47251libheif is a HEIF and AVIF file format decoder and encoder. …6.1
• CVE-2026-47254libheif is a HEIF and AVIF file format decoder and encoder. …6.1
• CVE-2026-47255AgenticMail gives AI agents real email addresses and phone n…8.2
• CVE-2026-4726Denial-of-service in the XML component. This vulnerability w…7.5
• CVE-2026-47261Wasmtime is a runtime for WebAssembly. In versions prior to …7.5
• CVE-2026-47262containerd is an open-source container runtime. Versions pri…5.5
• CVE-2026-47263Discourse is an open-source discussion platform. From versio…4.3
• CVE-2026-47264Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-47265AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2026-47266Formie is a Craft CMS plugin for creating forms. Prior to 2.…8.7