Read the docs
TI-2026-39339 Aliases CVE-2026-54493GHSA-6p96-cfg5-4vhp

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Priority HIGH 67CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed koel (koel): 9.7.0phanan/koel (Packagist): 9.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
koelkoelbefore 9.7.09.7.0Patch availableCNA
—phanan/koel (Packagist)before 9.7.09.7.0Patch availableGHSA-6p96-cfg5-4vhp
  • koel Vendorkoel Affected before 9.7.0 Fixed in 9.7.0 Patch available CNA
  • phanan/koel (Packagist) Vendor— Affected before 9.7.0 Fixed in 9.7.0 Patch available GHSA-6p96-cfg5-4vhp

Remediation

  • Fix · CNA koel (koel) Fixed in 9.7.0
  • Fix · GHSA-6p96-cfg5-4vhp phanan/koel (Packagist) Fixed in 9.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54493
  2. 2026-10-03 Alias added: GHSA-6p96-cfg5-4vhp

References

Other 5

  • TI-2026-34840 Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs CVSS 3.1HIGH 7.7
  • TI-2026-39337 Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths CVSS 3.1HIGH 7.1
  • TI-2026-39340 Server-side request forgery in koel CVSS 4.0MEDIUM 5.3
  • TI-2026-37274 Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail CVSS 3.1MEDIUM 6.3
  • TI-2026-39338 Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation CVSS 3.1MEDIUM 4.3
  • TI-2021-12956 Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences