p PatchFirst

CVE-2026-54494

CVE-2026-54494 · Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1

CVSS 5.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • koel

    Versions
    • < 9.7.1: Affected

    No fix published

  • phanan/koel Packagist

    Versions
    • 1.0.0-beta
    • v0.0.0-beta
    • v1.1.1
    • v1.1.2
    • v2.0.0
    • v2.0.1
    • v2.0.2
    • v2.1.0
    • v2.2.0
    • v2.2.1
    • v3.0.0
    • v3.0.1
    • v3.1.0
    • v3.1.1
    • v3.2.0
    • v3.3.0
    • v3.3.1
    • v3.4.0
    • v3.4.1
    • v3.5.0
    • v3.5.1
    • v3.5.2
    • v3.5.3
    • v3.5.4
    • v3.5.5
    • v3.6.0
    • v3.6.1
    • v3.6.2
    • v3.7.0
    • v3.7.1
    • v3.7.2
    • v4.0.0
    • v4.1.0
    • v4.1.1
    • v4.2.0
    • v4.2.1
    • v4.2.2
    • v4.3.0
    • v4.3.1
    • v4.4.0
    • v5.0.0
    • v5.0.1
    • v5.0.2
    • v5.1.0
    • v5.1.1
    • v5.1.10
    • v5.1.11
    • v5.1.12
    • v5.1.13
    • v5.1.14
    • v5.1.2
    • v5.1.3
    • v5.1.4
    • v5.1.5
    • v5.1.6
    • v5.1.7
    • v5.1.8
    • v5.1.9
    • v6.0.0
    • v6.0.1
    • v6.0.2
    • v6.0.3
    • v6.0.4
    • v6.0.5
    • v6.0.6
    • v6.1.0
    • v6.10.0
    • v6.11.0
    • v6.11.1
    • v6.11.2
    • v6.11.3
    • v6.11.4
    • v6.11.5
    • v6.12.0
    • v6.12.1
    • v6.2.0
    • v6.2.1
    • v6.2.2
    • v6.3.0
    • v6.4.0
    • v6.4.1
    • v6.4.2
    • v6.4.3
    • v6.5.0
    • v6.5.1
    • v6.5.2
    • v6.5.3
    • v6.6.0
    • v6.7.0
    • v6.7.1
    • v6.7.2
    • v6.7.3
    • v6.7.4
    • v6.7.5
    • v6.8.0
    • v6.8.1
    • v6.8.2
    • v6.8.3
    • v6.8.4
    • v6.8.5
    • v6.9.0
    • v7.0.0
    • v7.0.1
    • v7.0.10
    • v7.0.11
    • v7.0.12
    • v7.0.2
    • v7.0.3
    • v7.0.4
    • v7.0.5
    • v7.0.6
    • v7.0.7
    • v7.0.8
    • v7.0.9
    • v7.1.0
    • v7.10.0
    • v7.10.1
    • v7.10.2
    • v7.10.3
    • v7.10.4
    • v7.11.0
    • v7.12.0
    • v7.13.0
    • v7.14.0
    • v7.15.0
    • v7.15.1
    • v7.2.0
    • v7.2.1
    • v7.2.2
    • v7.3.0
    • v7.3.1
    • v7.4.0
    • v7.4.1
    • v7.4.2
    • v7.5.0
    • v7.5.1
    • v7.5.2
    • v7.6.0
    • v7.6.1
    • v7.6.2
    • v7.6.3
    • v7.7.0
    • v7.7.1
    • v7.8.0
    • v7.8.1
    • v7.9.0
    • v8.0.0
    • v8.1.0
    • v8.2.0
    • v8.3.0
    • v8.3.1
    • v9.0.0
    • v9.1.0
    • v9.1.1
    • v9.1.2
    • v9.2.0
    • v9.2.1
    • v9.3.0
    • v9.3.1
    • v9.3.2
    • v9.3.3
    • v9.3.4
    • v9.3.5
    • v9.3.6
    • v9.4.0
    • v9.4.1
    • v9.4.2
    • v9.5.0
    • v9.6.0
    • v9.7.0
    Affected ranges
    • ECOSYSTEM: < 9.7.1

    Update to 9.7.1

Original sources

Check your server →