Executive brief
Koel is an open-source personal music streaming service. A security flaw in its Subsonic-compatible radio feature allows an authorized user to trick the server into accessing internal network resources that are not normally accessible from the internet. This could allow an attacker to steal sensitive data from internal databases, admin panels, or cloud metadata services.
Technical details
A validation gap exists between Koel's standard web API and its Subsonic-compatible endpoints. While the web API uses 'SafeUrl' and 'HasAudioContentType' rules to prevent SSRF, the Subsonic routes (createInternetRadioStation.view and updateInternetRadioStation.view) lack these protections. An authenticated attacker can register a radio station with a URL pointing to internal services (e.g., loopback or RFC1918 addresses). When the station is played, the 'RadioStreamProxy::openStream' method uses 'fopen' on the attacker-controlled URL and forwards the resulting stream back to the client, resulting in a full-read SSRF. This is patched in version 9.7.0.
Affected products
- phanan koel <= 9.6.0
Timeline
- 2026-06-04: disclosed: Initial disclosure on GitHub Advisories
- 2026-07-15: advisory: Advisory updated with CVE-2026-54493
- 2026-07-15: patched: Fix released in version 9.7.0
References
- https://api.github.com/users/dennyabrahamsinaga
- https://github.com/dennyabrahamsinaga
- https://api.github.com/users/dennyabrahamsinaga/gists%7B/gist_id%7D
- https://api.github.com/users/dennyabrahamsinaga/repos
- https://avatars.githubusercontent.com/u/62960949?v=4
- https://api.github.com/users/dennyabrahamsinaga/events%7B/privacy%7D