CVE-2026-54491

Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.1

Description An authenticated user can perform Server-Side Request Forgery (SSRF) by supplying a URL that redirects to an internal address or by using DNS rebinding to change a public resolution to a private one. The application performs a point-in-time check using AppHelpersNetwork::isPublicHost() or isSafeUrl() but fails to pin the validated address or validate every redirect hop. This allows requests to be sent to internal services or cloud metadata endpoints, potentially leaking sensitive information such as IAM credentials on IMDSv1 instances.

Technical details include:

Recommendations Update to version 9.7.1. As a temporary mitigation, restrict access to the vulnerable functions PhanAnPoddlePoddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), AppRulesHasAudioContentType, and AppRulesSafeUrl to minimize the risk of exploitation.