Most recent entries from all

EUVD-2026-357449

fkie_cve-2026-54493

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.

GHSA-6p96-cfg5-4vhp — Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Affected: Packagist: phanan/koel

### Summary Koel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An authenticated user can create or update a radio station with a private URL and then use Koel's radio streaming feature to make the server fetch that URL and return the upstream response body.

This was validated against v9.6.0 (352ea5ec27fa22294da8fb6beacb3d5552f0d09c) using the official phanan/koel:9.6.0 image.

### Details #### SafeUrl is applied on the web API, but not on the Subsonic endpoints

Koel's regular radio API protects station URLs with `SafeUrl` and `HasAudioContentType`:

- `app/Http/Requests/API/Radio/RadioStationStoreRequest.php` - `app/Http/Requests/API/Radio/RadioStationUpdateRequest.php`

```php new SafeUrl(), new HasAudioContentType(), ```

The Subsonic-compatible routes do not reuse those checks:

- `routes/subsonic.php` - `createInternetRadioStation.view` - `updateInternetRadioStation.view` - `app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php` - `app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php`

```php return [ 'streamUrl' => ['required', 'string'], 'name' => ['required', 'string'], 'homepageUrl' => ['nullable', 'string'], ]; ```

The result is a validation gap between two routes that create the same type of object.

#### The unvalidated URL is stored and later fetched server-side

The Subsonic controllers hand the supplied URL to the regular r…