The flaw is a server‑side request forgery in the Subsonic API endpoints used to create and update internet radio stations. Authenticated users can supply a streamUrl that bypasses the normal sanitation checks, causing the Koel server to fetch the URL with PHP's fopen and return the raw upstream response. This allows the attacker to read data from internal network resources such as loopback interfaces, RFC1918 addresses, Docker bridge networks, or any host reachable from the Koel server, potentially exposing sensitive information or enabling further lateral movement.

Versions of Koel prior to 9.7.0 are impacted. The specific product is the Koel music streaming server (v9.6.x and earlier). Users who authenticate and have access to the Subsonic‑compatible routes for creating or updating internet radio stations can exploit the vulnerability.

The CVSS score of 7.7 indicates high severity. The EPSS score is not available, so present exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation yet. However, an authenticated attacker can supply a crafted URL and receive the downstream response, effectively probing internal services or reading internal data. Lack of outbound access controls or firewall restrictions on the Koel server raises the risk of unintended data exposure.