Read the docs
TI-2026-39340 Aliases CVE-2026-54494GHSA-rjg7-r26h-cfp2

Server-side request forgery in koel

Priority MEDIUM 63CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00427 37th percentileScored 2026-11-07
Fix Fixed koel (koel): 9.7.1phanan/koel (Packagist): 9.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
koelkoelbefore 9.7.19.7.1Patch availableCNA
—phanan/koel (Packagist)before 9.7.19.7.1Patch availableGHSA-rjg7-r26h-cfp2
  • koel Vendorkoel Affected before 9.7.1 Fixed in 9.7.1 Patch available CNA
  • phanan/koel (Packagist) Vendor— Affected before 9.7.1 Fixed in 9.7.1 Patch available GHSA-rjg7-r26h-cfp2

Remediation

  • Fix · CNA koel (koel) Fixed in 9.7.1
  • Fix · GHSA-rjg7-r26h-cfp2 phanan/koel (Packagist) Fixed in 9.7.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54494
  2. 2026-10-03 Alias added: GHSA-rjg7-r26h-cfp2

References

Other 5

  • TI-2026-39339 Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations CVSS 3.1HIGH 7.7
  • TI-2026-34840 Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs CVSS 3.1HIGH 7.7
  • TI-2026-39337 Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths CVSS 3.1HIGH 7.1
  • TI-2026-37274 Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail CVSS 3.1MEDIUM 6.3
  • TI-2026-39338 Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation CVSS 3.1MEDIUM 4.3
  • TI-2021-12956 Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences