Skip to content
Threat Feed
Subscribe

Tag

Koel

2 briefs RSS
high advisory

Koel Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

An authenticated user can exploit a Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-54493, in Koel v9.6.0 via the Subsonic-compatible radio endpoints, which lack proper URL validation, allowing the server to fetch and return the body of internal network resources.

Koel ssrf web-application vulnerability subsonic
1r 2t
high advisory

Koel SSRF Vulnerability via Podcast Episode Enclosure URLs (CVE-2026-47260)

Koel is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of podcast episode enclosure URLs, allowing a remote attacker to inject a malicious URL into the enclosure field of a podcast RSS feed, leading to internal network reconnaissance and potential credential theft; this issue is tracked as CVE-2026-47260.

koel ssrf podcast cloud
2r 1t 3i