VulnSocial

CVE-2026-47260General

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-13); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-13: 1Mentions · 2026-06-15: 1Technical Details · 2026-06-15: 106-1306-15
Signal classification2 categories
General
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-131
General1
2026-06-151
Disclosure1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    #CVE-2026-47260 - #SSRF in Koel music streaming prior to 9.3.5 Episode enclosure URLs bypass validation, allowing server-side request forgery #CVSS 7.7 #infosec #cybersecurity #pentesting #pentesters #CVEAlert #100daysofcybersecurity Detailed info: https://www.valtersit.com/cve/CVE-2026-47260/

    Post summary

    The post announces the discovery of an SSRF vulnerability (CVE-2026-47260) in Koel music streaming (versions <9.3.5), explaining that episode enclosure URLs bypass validation to enable server‑side request forgery, and provides a CVSS score of 7.7 with a link for further details.

    0000045
    929 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-47260 Server-Side Request Forgery in Koel Music Streaming Prior to Version 9.3.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47260

    Post summary

    The post merely announces a Server‑Side Request Forgery vulnerability in Koel Music Streaming before version 9.3.5, without providing additional technical detail, exploit code, or mitigation steps.

    0000041
    4.0K followersView on X

Explore more

Back to dashboard