These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Koel, a free and open-source music streaming solution, is vulnerable to an issue that allows authenticated users to access internal HTTP services via Subsonic-compatible routes in versions prior to 9.7.0. The vulnerability arises from insufficient SafeUrl and HasAudioContentType checks in the createInternetRadioStation.view and updateInternetRadioStation.view routes. These routes pass the stored URL throu [truncated]
CVE-2026-54492 is a vulnerability in Koel, a free, open-source music streaming solution. The Subsonic-compatible createPodcastChannel.view route in Koel versions prior to 9.7.0 accepts an authenticated user's private URL without applying SafeUrl validation, leading to blind internal request execution. This issue is fixed in version 9.7.0. Defenders should assess exposure, prioritize upgrading, and monitor [truncated]
CVE-2026-54491 is a vulnerability in Koel, a free, open-source music streaming solution. Prior to version 9.7.1, the application performs insufficient validation of outbound podcast and radio fetch paths, allowing an authenticated user to potentially receive parsed or streamed response content from internal services or cloud metadata by requesting internal addresses.
CVE-2026-50552 is a Server-Side Request Forgery (SSRF) vulnerability in Koel, a free, open-source music streaming solution. The vulnerability affects Koel prior to version 9.7.1. The SSRF vulnerability is located in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared without the bail keyword, allowing the HasAudioContentType rule to execute even afte [truncated]
CVE-2026-47260 is a Server-Side Request Forgery (SSRF) vulnerability in Koel, a free, open-source music streaming solution. The vulnerability allows attackers to access internal services by exploiting the podcast feed URL validation mechanism. Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but fails to validate individual episode enclosure URLs extracted from [truncated]