CVE-2026-54493

Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.0

Description An authenticated user can perform a Server-Side Request Forgery (SSRF) via Subsonic-compatible endpoints. The createInternetRadioStation.view and updateInternetRadioStation.view routes fail to implement the SafeUrl and HasAudioContentType checks used by the standard radio API. This allows an attacker to provide a private URL in the streamUrl variable, which is then processed by the openStream() function in app/Services/Radio/RadioStreamProxy.php using fopen(). By accessing the /radio/stream/{id} endpoint, the attacker can retrieve the full response body from internal HTTP services, including loopback, RFC1918, Docker bridge, or metadata services reachable by the server.

Recommendations Update to version 9.7.0. As a temporary mitigation, restrict access to the createInternetRadioStation.view and updateInternetRadioStation.view endpoints or avoid using the streamUrl parameter with internal network addresses.