Koel vulnerabilities
Products
- Koel 7
Newest
- koel Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4 5.3 Medium
- koel Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths 7.1 High
- koel Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations 7.7 High
- koel Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation 4.3 Medium
- koel Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail 6.3 Medium
- koel Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs 7.7 High
- koel Improper rate limiting in Koel 7.5 High