CVE-2026-54492
MediumCVSS 4.3Summary
Koel before version 9.7.0 in the Subsonic createPodcastChannel.view route does not apply SafeUrl validation, allowing an authenticated user to provide a private URL. This causes immediate server-side requests to loopback, Docker bridge, or RFC1918 destinations.
Risk Assessment
The confirmed impact is blind internal request execution, which could allow an attacker to scan the internal network or access otherwise unreachable services.
Recommendation
Update Koel to version 9.7.0, which fixes the URL validation in Subsonic requests.
Original NVD description (English source)
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0.