Description

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-19T21:16:57.743Z",
  "pubdate": "2026-08-19T21:16:57.743Z",
  "executiveSummary": "An authenticated Server-Side Request Forgery (SSRF) vulnerability affects Koel prior to version 9.7.0 within its Subsonic-compatible internet radio station management routes. The vulnerability allows an authenticated attacker to supply arbitrary stream URLs that bypass standard validation checks, forcing the underlying server to execute arbitrary outbound HTTP requests via fopen(). Successful exploitation enables malicious actors to interact with loopback addresses, RFC1918 private networks, Docker bridge interfaces, internal metadata services, and other sensitive internal HTTP infrastructure reachable from the host running the Koel server. The risk implications include unauthorized internal network reconnaissance, data exfiltration from internal services, and potential interaction with vulnerable internal APIs. Exploitation requires valid user authentication to access the affected Subsonic routes and the ability to configure internet radio station parameters.",
  "technicalDetails": "The vulnerability resides in the Subsonic-compatible API routes createInternetRadioStation.view and updateInternetRadioStation.view within Koel prior to version 9.7.0. The root cause stems from the omission of critical input validation mechanisms—specifically the SafeUrl and HasAudioContentType checks that are otherwise enforced within the standard radio API implementation. When an authenticated user submits requests to create or update an internet radio station, the supplied streamUrl parameter is handled by app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php.\nThese validation request classes pass the unvalidated stored URL through app/Services/RadioService.php directly to app/Services/Radio/RadioStreamProxy.php. Within this component, the RadioStreamProxy::openStream() method executes a native PHP fopen($url, 'r', false, $context) call using the provided URL. Because the URL lacks sufficient sanitization and restriction checks, the PHP runtime initiates an arbitrary outbound connection based on the user-controlled input.\nThe attack flow proceeds as follows: 1. An authenticated attacker crafts a request to the createInternetRadioStation.view or updateInternetRadioStation.view endpoints containing a malicious streamUrl pointing to an internal resource (e.g., http://127.0.0.1/, local metadata services like 169.254.169.254, RFC1918 private network ranges, or Docker bridge IP addresses). 2. The Koel application stores and processes the URL without enforcing SafeUrl or HasAudioContentType validation. 3. When a client or the application invokes the streaming endpoint at /radio/stream/{id}, RadioStreamProxy::openStream() triggers a file open operation via fopen() using the target URL. 4. The upstream response body from the internal service is retrieved and returned to the caller through the streaming response.\nThe affected component spans the Subsonic request validation classes, RadioService, and RadioStreamProxy. Affected versions include all releases prior to 9.7.0. Prerequisites for exploitation include valid user authentication and network exposure to the Subsonic API endpoints. Post-exploitation impact encompasses unauthorized access to internal network services, exposure of internal HTTP interfaces, and potential exploitation of adjacent unauthenticated or vulnerable microservices residing within the same internal or containerized network perimeter."
}