CVE-2026-47260 Details
Description
Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.
A server-side request forgery (SSRF) vulnerability has been identified in Koel, a music streaming application, in versions prior to 9.3.5. The issue arises because the application validates podcast feed URLs using the SafeUrl rule, which checks DNS resolution and public IP addresses. However, the individual episode enclosure URLs extracted from the RSS feed are stored in the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL and streams it back to the user. This behavior enables an attacker to read internal services' responses, potentially leading to unauthorized access to sensitive data or services.
Users can update to Koel version 9.3.5 or later, where this vulnerability has been patched. The patch includes validation of episode enclosure URLs to ensure they are safe before they are accessed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a | [email protected] | Source CodeVendor |
| https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Koel | <= 9.3.4 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 13, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |