CVE-2026-54493
HighCVSS 7.7Summary
In Koel before 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without SafeUrl and HasAudioContentType checks. The stored URL is passed to RadioStreamProxy::openStream(), which calls fopen($url, 'r', false, $context). This allows access to internal HTTP services such as loopback, RFC1918, Docker bridge, or metadata.
Risk Assessment
The risk is that the Koel server can be used to probe internal networks and access sensitive services, including cloud metadata, potentially leading to data leakage.
Recommendation
Upgrade Koel to version 9.7.0 or later. Also restrict API access and apply proper URL validation filters.
Original NVD description (English source)
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.