Is CVE-2026-47260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47260 being exploited in the wild.

How severe is CVE-2026-47260?

High severity, with a CVSS score of 7.7, published 12 June 2026.

Which products and versions are affected?

phanan/koel (Packagist) <= 9.3.4, ECOSYSTEM:introduced=0,fixed=9.3.5; Phanan Koel <= 9.3.4.

Is there a fix for CVE-2026-47260?

Yes. phanan/koel (Packagist): upgrade to 9.3.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47260 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-47260?

Check whether you run phanan/koel (Packagist) or Phanan Koel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47260: Koel SSRF in podcast episode enclosure URLs

Q: Is there a fix for CVE-2026-47260?

Yes. phanan/koel (Packagist): upgrade to 9.3.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47260 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-47260?

Check whether you run phanan/koel (Packagist) or Phanan Koel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47260 · Severity: high · CVSS 7.7 · Published 2026-06-12

Koel is an open-source music streaming platform. A security flaw allows authenticated users to trick the server into making unauthorized requests to internal systems by providing a malicious podcast feed. This could allow an attacker to steal sensitive cloud credentials or access private internal services that are not normally exposed to the internet.

Technologies: phanan/koel (Packagist), Phanan Koel. Vendors: Packagist, Phanan.

Quick answers

Is CVE-2026-47260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47260 being exploited in the wild.
How severe is CVE-2026-47260?: High severity, with a CVSS score of 7.7, published 12 June 2026.
Which products and versions are affected?: phanan/koel (Packagist) <= 9.3.4, ECOSYSTEM:introduced=0,fixed=9.3.5; Phanan Koel <= 9.3.4.
Is there a fix for CVE-2026-47260?: Yes. phanan/koel (Packagist): upgrade to 9.3.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47260 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-47260?: Check whether you run phanan/koel (Packagist) or Phanan Koel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phanan/koel (Packagist): upgrade to 9.3.5 or later
```
composer require phanan/koel:^9.3.5
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Koel's podcast processing logic. While the application validates the primary podcast feed URL using a 'SafeUrl' rule, it fails to validate individual episode enclosure URLs extracted from the RSS XML. These unvalidated URLs are stored in the database and subsequently requested by the server using 'Http::sink()->get()' when a user attempts to play an episode. Because the server streams the full HTTP response back to the user, an attacker with low-level account privileges can perform a full-read SSRF. This can be used to exfiltrate sensitive data from internal services, such as AWS/GCP/Azure metadata endpoints. A secondary SSRF vector was also identified in the AI Radio Station tool which bypassed similar validation rules. The issue is patched in version 9.3.5.

Affected products

Koel Koel < 9.3.5

Identifiers

CVE-2026-47260
GHSA-7j2f-6h2r-6cqc

Timeline

2026-05-18: patched: Fix committed and advisory published by maintainer
2026-06-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.