Security Advisories - phanan/koel - Packagist.org

phanan/koel Security Advisories for v9.7.0 (3)

[MEDIUM] Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

PKSA-nwpt-px6q-b5bv CVE-2026-54494 GHSA-rjg7-r26h-cfp2

Affected version: <=9.7.0

Reported by:
GitHub
[MEDIUM] Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

PKSA-69y7-vwnx-px15 CVE-2026-50552 GHSA-jr4p-4xjh-fwvw

Affected version: <=9.7.0

Reported by:
GitHub
[HIGH] Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

PKSA-1qtf-pcfh-kb47 CVE-2026-54491 GHSA-6qvr-wjmv-v8mm

Affected version: <=9.7.0

Reported by:
GitHub