CVE-2026-54494

Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.1

Description An authenticated user can perform a server-side request forgery (SSRF) by subscribing to a malicious podcast RSS feed. The application's outbound-URL guard AppHelpersNetwork::isPublicHost() uses filter var() with FILTER FLAG NO PRIV RANGE and FILTER FLAG NO RES RANGE, which fails to recognize IPv6 transition-address forms that embed private, loopback, or link-local IPv4 addresses. Specifically, NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers are incorrectly treated as public addresses.

An attacker can place such an address in a podcast RSS <enclosure url> to reach app/Values/Podcast/EpisodePlayable.php through the EpisodePlayable::createForEpisode() function. The isSafeUrl() guard accepts the target, and Http::sink($file)->get($url) fetches the content. On hosts with NAT64 or 6to4 routing, this allows the attacker to request internal services or cloud instance metadata (such as AWS/GCP IMDS) and receive the response body.

Recommendations Update Koel to version 9.7.1. As a temporary mitigation, restrict the use of the EpisodePlayable::createForEpisode() function or limit the ability of users to subscribe to external RSS feeds until the update is applied.