This vulnerability is a Server-Side Request Forgery (SSRF) in the sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar, affecting versions up to 5.11. SSRF vulnerabilities allow attackers to make the server perform unauthorized requests, which can lead to information disclosure or manipulation of internal resources. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, with partial confidentiality and integrity impacts but no availability impact. The vulnerability is published and tracked as CVE-2026-39647 but lacks an official remediation or patch at this time.

The impact includes potential limited confidentiality and integrity loss due to SSRF, which could allow attackers to access internal resources or sensitive information indirectly through the vulnerable server. There is no indication of availability impact or known exploitation in the wild. The medium CVSS score reflects these moderate risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the vulnerable component and applying network-level controls to limit SSRF exploitation vectors if feasible.