CVE-2026-54494Medium▾ SunlitKoel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 w…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
phanan/koel <= 9.7.0Patched in:
phanan/koel 9.7.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54491High· 7.1Koel is a free, open-source music streaming solution
CVE-2026-50552Medium· 6.3Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
CVE-2026-54492Medium· 4.3Koel is a free, open-source music streaming solution
CVE-2026-54493High· 7.7Koel is a free, open-source music streaming solution
GHSA-8q6q-m837-fv64Medium· 6.4Koel has SSRF through Authenticated Subsonic podcast feed URLs
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents