phanan/koel vulnerabilities (Packagist)
8 vulnerabilities.
-
phanan/koelPackagist Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4 5.3 Medium -
phanan/koelPackagist Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths 7.1 High -
phanan/koelPackagist Koel has SSRF through Authenticated Subsonic podcast feed URLs 6.4 Medium -
phanan/koelPackagist Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations 7.7 High -
phanan/koelPackagist Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation 4.3 Medium -
phanan/koelPackagist Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail 6.3 Medium -
phanan/koelPackagist Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs 7.7 High -
phanan/koelPackagist Improper rate limiting in Koel 7.5 High