EUVD-2026-326975

fkie_cve-2026-47260

Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public IP check), but the individual episode <enclosure url="..."> values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via Http::sink()->get() and streams it back to the user, enabling full-read SSRF against internal services. This issue has been patched in version 9.3.5.

GHSA-7j2f-6h2r-6cqc — Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs

Affected: Packagist: phanan/koel

## Summary

Koel validates the podcast feed URL via the `SafeUrl` rule (DNS resolution + public IP check), but the individual episode `<enclosure url="...">` values extracted from the RSS XML are stored directly into the database without any SSRF validation. When a user plays an episode, the server downloads the full HTTP response from the unvalidated enclosure URL via `Http::sink()->get()` and streams it back to the user, enabling full-read SSRF against internal services.

---

## Vulnerability Details

### Episode URL Stored Without Validation

**File:** `app/Services/Podcast/PodcastService.php`, line 146

```php 'path' => $episodeValue->enclosure->url, // Unvalidated URL from RSS XML ```

The `SafeUrl` rule is applied to the podcast feed URL at subscription time (`SubscribeToPodcastRequest`), but episode enclosure URLs parsed from the feed XML are stored as-is.

### SSRF Trigger: Full Content Download

**File:** `app/Values/Podcast/EpisodePlayable.php`, line 42

```php Http::sink($file)->get($episode->path)->throw(); ```

When an episode is played, `PodcastStreamerAdapter::stream()` first attempts `getStreamableUrl()` (OPTIONS/HEAD requests to the episode URL). If no CORS header is present (which internal services won't have), it falls through to `EpisodePlayable::createForEpisode()`, which downloads the full response body and streams it back to the user.

### SafeUrl Applied Only to Feed URL

**File:** `app/Http/Requests/API/Podcast/SubscribeToPodcastRequest.php`

```ph…

Most recent entries from all

EUVD-2026-326975

fkie_cve-2026-47260

GHSA-7j2f-6h2r-6cqc — Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs