[MEDIUM] Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

PKSA-nwpt-px6q-b5bv CVE-2026-54494 GHSA-rjg7-r26h-cfp2

Affected package: phanan/koel

Affected version: <=9.7.0

Reported by:
GitHub