Executive brief
Koel, an open-source personal audio streaming service, is vulnerable to a security flaw in its Subsonic-compatible podcast feature. An authenticated user can trick the server into making unauthorized requests to internal network resources that are normally protected. This could allow an attacker to probe internal services or interact with private systems within the corporate or home network where Koel is hosted.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Koel versions up to 9.6.0 due to insufficient validation in the Subsonic-compatible 'createPodcastChannel.view' route. While the primary podcast API uses a 'SafeUrl' validation rule to block private IP ranges, the Subsonic route in 'app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php' only checks for a generic URL string. An authenticated attacker can provide a loopback or internal RFC1918 address, which is then immediately fetched by the 'PodcastService' during the channel creation flow. This allows for internal service discovery and request execution. The issue is addressed in version 9.7.0 by applying the 'SafeUrl' rule to the Subsonic request validator.
Affected products
- phanan koel <= 9.6.0
Timeline
- 2026-06-04: disclosed
- 2026-07-15: advisory
- 2026-07-15: patched: Fixed in version 9.7.0
References
- https://api.github.com/users/dennyabrahamsinaga
- https://github.com/dennyabrahamsinaga
- https://api.github.com/users/dennyabrahamsinaga/gists%7B/gist_id%7D
- https://api.github.com/users/dennyabrahamsinaga/repos
- https://avatars.githubusercontent.com/u/62960949?v=4
- https://api.github.com/users/dennyabrahamsinaga/events%7B/privacy%7D