Description

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular podcast API. app/Http/Controllers/Subsonic/CreatePodcastChannelController.php passes the URL to app/Services/Podcast/PodcastService.php, where PodcastService::addPodcast() and createParser() invoke Poddle::fromUrl() during channel creation, causing immediate server-side requests to loopback, Docker bridge, or RFC1918 HTTP destinations. The confirmed impact is blind internal request execution because generic response-body exfiltration was not demonstrated through this route. This issue is fixed in version 9.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T21:16:57.600Z",
  "pubdate": "2026-08-19T21:16:57.600Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Koel prior to version 9.7.0 within the Subsonic-compatible createPodcastChannel.view route. The flaw allows authenticated users to supply private or internal URLs that bypass intended validation mechanisms, resulting in unauthorized server-side HTTP requests targeting loopback addresses, Docker bridge interfaces, or RFC1918 private network spaces. The confirmed impact is blind internal request execution, as generic response-body exfiltration was not demonstrated through this specific endpoint. Exploitation requires authenticated access to the application, specifically leveraging the Subsonic API integration. The risk involves potential scanning, interaction with internal microservices, or exploitation of local services accessible from the hosting server. Remediation requires upgrading the Koel installation to version 9.7.0 or later, where proper URL validation is enforced.",
  "technicalDetails": "The vulnerability stems from an inconsistency in input validation routines across different API routes within the Koel music streaming solution. Specifically, the Subsonic-compatible createPodcastChannel.view route handles requests via the app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php form request class. Unlike the regular podcast API endpoints, this request handler fails to apply the robust SafeUrl validation logic required to restrict input to permitted external destinations.\nDuring the attack flow, an authenticated user submits a crafted payload containing a private or internal URL to the vulnerable createPodcastChannel.view endpoint. The incoming parameters are processed by app/Http/Controllers/Subsonic/CreatePodcastChannelController.php, which subsequently passes the unvalidated URL parameter to app/Services/Podcast/PodcastService.php. Within this service class, the execution flow invokes PodcastService::addPodcast() and createParser() methods, which ultimately trigger Poddle::fromUrl() during the channel creation process.\nThe execution of Poddle::fromUrl() initiates an immediate HTTP request from the underlying server hosting Koel to the supplied destination. Because proper egress filtering and URL scheme checks are absent in this code path, the application attempts to connect to restricted network locations, including loopback interfaces (127.0.0.1), Docker bridge networks, and RFC1918 private address spaces (e.g., 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12).\nThe affected component spans multiple application layers, including app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php, app/Http/Controllers/Subsonic/CreatePodcastChannelController.php, and app/Services/Podcast/PodcastService.php. Affected versions include all deployments of Koel prior to 9.7.0. The vulnerability requires authentication to the application, leveraging access to the Subsonic API functionality, and exhibits a blind SSRF impact profile where internal requests are executed without direct response-body exfiltration back to the client through the vulnerable route."
}