Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

phanan/koel

7 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 3 high, 3 medium
Registry
Packagist

Advisories 7

  • Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

    Affected: fixed in 9.7.1.

  • Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

    Affected: fixed in 9.7.0.

  • CVE-2026-54494Medium 5.3

    Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16)…

    Affected: fixed in 9.7.1.

  • CVE-2026-54492Medium 4.3

    Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

    Affected: fixed in 9.7.0.

  • CVE-2026-50552Medium 6.3

    Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

    Affected: fixed in 9.7.1.

  • Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs

    Affected: fixed in 9.3.5.

  • Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username.

    Affected: fixed in 5.1.4.