{"data":{"id":"38efe0af-c71a-46d5-b5c5-df5410d11cf0","title":"GHSA-7j2f-6h2r-6cqc: Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs","summary":"Koel validates podcast feed URLs with the SafeUrl rule, but episode enclosure URLs parsed from RSS XML are stored in the database without SSRF checks. When an episode plays, the server downloads the full response from that unvalidated URL through Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services such as cloud metadata endpoints.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-7j2f-6h2r-6cqc","publishedAt":"2026-05-29T19:56:06.000Z","cveId":"CVE-2026-47260","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["phanan/koel@<= 9.3.4 (fixed: 9.3.5)"],"affectedPackageNames":["phanan/koel"],"affectedPackageRefs":["composer:phanan/koel"],"affectedVendors":[],"affectedVendorsRaw":["Koel"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00354,"epssCheckedAt":"2026-10-14T06:09:06.038Z","kevDateAdded":null,"advisoryAliases":["GHSA-7j2f-6h2r-6cqc"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-29T19:56:06.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null}}