Description
Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1
Published: 2026-08-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a Server‑Side Request Forgery that allows an authenticated user to craft a podcast RSS feed containing a NAT64 or 6to4 IPv6 wrapper of a private IPv4 address. The application incorrectly treats the address as public because filter_var() used with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE accepts it. When the feed is processed, the app fetches the target endpoint and returns the response body to the user, enabling access to internal services or cloud metadata.

Affected Systems

Koel, the free, open‑source music streaming solution, is affected in all releases prior to version 9.7.1. The issue was fixed in v9.7.1, so any older installation that hosts an authenticated user interface allowing the creation of podcast RSS feeds is vulnerable.

Risk and Exploitability

The CVSS‑3.1 base score is 5.3, indicating a moderate risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need authenticated access to the application to provide the malicious podcast file; from there they can cause the server to request arbitrary internal or cloud endpoints, potentially exposing internal data or leveraging cloud metadata. The vulnerability is best mitigated by upgrading, as no workaround is officially provided.

Generated by OpenCVE AI on August 20, 2026 at 08:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Koel v9.7.1 or newer to apply the fix that blocks NAT64/6to4 addresses.
  • Temporarily disable the podcast RSS feed feature or restrict it to trusted users until the upgrade can be performed.
  • Add network rules or firewall configurations to block outgoing requests from the application to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to further mitigate possible SSRF exploitation.

Generated by OpenCVE AI on August 20, 2026 at 08:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rjg7-r26h-cfp2 Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
History

Tue, 25 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Koel
Koel koel
Vendors & Products Koel
Koel koel

Wed, 19 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Description Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1
Title Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Koel Koel
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T14:14:08.109Z

Reserved: 2026-06-15T18:01:15.510Z

Link: CVE-2026-54494

cve-icon Vulnrichment

Updated: 2026-08-25T14:13:52.216Z

cve-icon NVD

Status : Received

Published: 2026-08-19T21:16:57.910

Modified: 2026-08-25T15:16:32.820

Link: CVE-2026-54494

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T08:15:17Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)