GHSA-gmxh-hjfv-qc2w

Koillection has an authenticated Server-Side Request Forgery issue

Source: GitHub Advisory Database (reviewed) High CVE-2026-50888

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	koillection/koillection	< 1.8.4	1.8.4

Details

As written in the advisory (Markdown source, shown as plain text).

An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-50888 advisory
https://github.com/benjaminjonard/koillection/pull/1599 web
https://github.com/benjaminjonard/koillection/commit/4d445e21c631c26070f19fe8ec086a2939767ae0 web
https://gist.github.com/pyuysig/d60273c1c346257ceddbf8da7134bae7 web
https://github.com/benjaminjonard/koillection package
https://github.com/benjaminjonard/koillection/releases/tag/1.8.4 web