Koel up to 9.7.0 Network Helper EpisodePlayable.php isPublicHost url infinite loop

Summaryinfo

A vulnerability was found in Koel up to 9.7.0. It has been declared as problematic. Impacted is the function App\Helpers\Network::isPublicHost of the file app/Values/Podcast/EpisodePlayable.php of the component Network Helper. The manipulation of the argument url results in infinite loop. This vulnerability is known as CVE-2026-54494. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Koel up to 9.7.0. Affected is the function App\Helpers\Network::isPublicHost of the file app/Values/Podcast/EpisodePlayable.php of the component Network Helper. The manipulation of the argument url with an unknown input leads to a infinite loop vulnerability. CWE is classifying the issue as CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. This is going to have an impact on confidentiality. CVE summarizes:

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-54494 since 06/15/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

By approaching the search of inurl:app/Values/Podcast/EpisodePlayable.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 9.7.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Koel

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7.0

Website

• Product: https://github.com/koel/koel/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion