Homepage

Server-side Request Forgery (SSRF) Affecting phanan/koel package, versions <9.7.0

Severity

 Recommended
0.0
high
0
10

CVSS assessment by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PHP-PHANANKOEL-17984483
  • published15 Jul 2026
  • disclosed15 Jul 2026
  • creditUnknown
Report a new vulnerability Found a mistake?

Introduced: 15 Jul 2026

CVE NOT AVAILABLE CWE-918  (opens in a new tab)

How to fix?

Upgrade phanan/koel to version 9.7.0 or higher.

Overview

phanan/koel is a personal audio streaming service.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the createPodcastChannel.view endpoint and the PodcastService::getStreamableUrl process. An attacker can cause the backend to make arbitrary HTTP requests to internal or external services by supplying crafted URLs, potentially accessing internal resources or exposing sensitive information through server responses. This is only exploitable if the attacker has a valid user account and Subsonic API key.

CVSS Base Scores

version 4.0
version 3.1