CVE-2026-54491 Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost or isSafeUrl check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every...

CVE-2026-54491

creationtimestamp| type| source ---|---|--- 2026-07-15 18:35:12+00:00| published-proof-of-concept| https://github.com/koel/koel/security/advisories/GHSA-6qvr-wjmv-v8mm...