Skip to content
OpenAdvisories

Vendor

koel

6 known vulnerabilities.

koel at a glance

Last 12 months
6
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 4 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202640
Jul 202600
Jun 202620
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Most common weaknesses

Products

koel 6
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 7.1
    CVE-2026-54491

    Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

    Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-h…

    koel koel phanan/koel Packagist
  • High 7.7
    CVE-2026-54493

    Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

    Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType check…

    koel koel phanan/koel Packagist
  • Medium 5.3
    CVE-2026-54494

    Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

    Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, lo…

    koel koel phanan/koel Packagist
  • Medium 4.3
    CVE-2026-54492

    Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

    Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the Saf…

    koel koel phanan/koel Packagist
  • Medium 6.3
    CVE-2026-50552

    Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

    Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared witho…

    koel koel phanan/koel Packagist
  • High 7.7
    CVE-2026-47260

    Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs

    Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are s…

    koel koel phanan/koel Packagist