CVE-2026-54492

Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.0

Description An authenticated user can trigger server-side requests to internal destinations, such as loopback, Docker bridge, or RFC1918 HTTP addresses, because the Subsonic-compatible createPodcastChannel.view endpoint does not apply the SafeUrl validation used by the regular podcast API. When a private URL is provided via the url parameter, the CreatePodcastChannelController.php passes it to PodcastService.php, where the addPodcast() and createParser() functions invoke Poddle::fromUrl(). This results in blind internal request execution during the channel creation process. SSRF (Server-Side Request Forgery) is a vulnerability where an attacker forces a server to make requests to an unintended location, often used to bypass firewalls or access internal services.

Recommendations Update Koel to version 9.7.0. As a temporary mitigation, restrict access to the createPodcastChannel.view endpoint or avoid using the url parameter with internal network addresses.