CVE-2026-54493 in Koel
Summary
by MITRE • 08/20/2026
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
Koel is a free and open-source music streaming solution that provides users with the ability to manage and stream their personal media libraries. The application includes features compatible with the Subsonic API, allowing integration with various third-party clients. A critical security vulnerability was identified in versions prior to 9.7.0 regarding how internet radio stations are created or updated through specific API endpoints. These endpoints accept a user-provided URL for an audio stream without applying the same rigorous validation checks that are enforced by other parts of the application's radio functionality. Specifically, the createInternetRadioStation.view and updateInternetRadioStation.routes failed to utilize SafeUrl verification or HasAudioContentType checks, which are standard safeguards designed to ensure that provided URLs point to legitimate external resources rather than internal system addresses.
The technical flaw stems from a lack of input validation in the request handling layer for these specific routes. When an authenticated user submits a stream URL via these endpoints, the application passes this value through several service classes, including RadioService and ultimately to RadioStreamProxy. The critical failure occurs within the openStream method of RadioStreamProxy, which invokes PHP's fopen function with the provided URL as its first argument. Because no validation is performed on the scheme or destination of this URL before it reaches fopen, an attacker can supply a maliciously crafted URL that targets internal network resources. This behavior effectively turns the Koel server into a Server-Side Request Forgery (SSRF) vector, allowing the application to make HTTP requests on behalf of the user to destinations not intended for public access.
The operational impact of this vulnerability is significant due to its potential for data exfiltration and internal network reconnaissance. By exploiting this SSRF flaw, an authenticated attacker can direct the Koel server to fetch content from loopback interfaces, RFC1918 private IP ranges, or Docker bridge networks that are reachable from the host running Koel but not accessible directly from the internet. This capability allows attackers to access sensitive metadata services, internal HTTP APIs, cloud instance metadata endpoints, and other critical infrastructure components hidden behind firewalls or network segmentation. The vulnerability is particularly dangerous because it leverages existing authentication mechanisms; any user with a valid account can exploit this flaw without needing elevated privileges, making it accessible to a broad range of potential adversaries who have gained access to the application interface.
This issue aligns with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where a web server makes requests from an internal network based on user-supplied data. In terms of offensive security frameworks, this vulnerability maps to ATT&CK technique T1571, specifically the Proxy Communication subtechnique, as it involves using a trusted application to bypass perimeter defenses and access internal resources. It also relates to CWE-20, Improper Input Validation, due to the failure to sanitize or validate the scheme and host of the provided URL before processing. The lack of restriction on local addresses represents a fundamental breach in secure coding practices regarding network resource accessibility.
To mitigate this vulnerability, organizations running Koel must upgrade immediately to version 9.7.0 or later, where these specific routes have been patched to include proper validation checks similar to those used by the regular radio API. For environments that cannot update immediately due to compatibility constraints, implementing a web application firewall rule to block outbound requests from the Koel server IP address to private IP ranges and loopback addresses can provide an effective compensating control. Additionally, network segmentation strategies should be reviewed to ensure that critical internal services are not accessible from the host running public-facing applications like Koel, thereby reducing the attack surface even if such vulnerabilities exist in third-party software.