HIGH7.7Packagist
GHSA-6p96-cfg5-4vhp· CVE-2026-54493Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Modified: 7/15/2026
package
Packagist/phanan/koel
pkg:packagist/phanan/koel
HIGH7.1Packagist
GHSA-6qvr-wjmv-v8mm· CVE-2026-54491Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Modified: 7/15/2026
HIGH7.7Packagist
GHSA-7j2f-6h2r-6cqc· CVE-2026-47260Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
Modified: 9/10/2026
MEDIUM6.4Packagist
GHSA-8q6q-m837-fv64Koel has SSRF through Authenticated Subsonic podcast feed URLs
Modified: 7/15/2026
MEDIUM6.3Packagist
GHSA-jr4p-4xjh-fwvw· CVE-2026-50552Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
Modified: 7/15/2026
HIGHPackagist
GHSA-r37h-j483-cjjm· CVE-2021-33563Improper rate limiting in Koel
Modified: 12/2/2024
MEDIUMPackagist
GHSA-rjg7-r26h-cfp2· CVE-2026-54494Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Modified: 7/15/2026
MEDIUM4.3Packagist
GHSA-w79m-f3jx-779v· CVE-2026-54492Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
Modified: 7/15/2026