GHSA-W79M-F3JX-779V Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...

PT-2026-60384

Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.0 Description An authenticated user can trigger server-side requests to internal destinations, such as loopback, Docker bridge, or RFC1918 HTTP addresses, because the Subsonic-compatible createPodcastChannel.view...