CVE-2026-54493

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54493
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54493.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54493
Aliases
Published
2026-08-19T20:46:50Z
Modified
2026-09-11T03:30:38Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Details

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54493.json"
}
References

Affected packages

Git / github.com/koel/koel

Affected ranges

Type
GIT
Repo
https://github.com/koel/koel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1331f335342b405e60ffabdd60f1f398508f996f
Fixed
8ee1de0f5589ef34d3e3bbb9c9555a5de69eaf06
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.7.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.0-beta
Other
latest
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v3.*
v3.0.0
v3.0.1
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.4.0
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.5.5
v3.6.0
v3.6.1
v3.6.2
v3.7.0
v3.7.1
v3.7.2
v4.*
v4.0.0
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.4.0
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.1.10
v5.1.11
v5.1.12
v5.1.13
v5.1.14
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.1.7
v5.1.8
v5.1.9
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.1.0
v6.10.0
v6.11.0
v6.11.1
v6.11.2
v6.11.3
v6.11.4
v6.11.5
v6.12.0
v6.12.1
v6.2.0
v6.2.1
v6.2.2
v6.3.0
v6.4.0
v6.4.1
v6.4.2
v6.4.3
v6.5.0
v6.5.1
v6.5.2
v6.5.3
v6.6.0
v6.7.0
v6.7.1
v6.7.2
v6.7.3
v6.7.5
v6.8.0
v6.8.1
v6.8.2
v6.8.3
v6.8.4
v6.8.5
v6.9.0
v7.*
v7.0.0
v7.0.1
v7.0.10
v7.0.11
v7.0.12
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.6
v7.0.7
v7.0.8
v7.0.9
v7.1.0
v7.10.0
v7.10.1
v7.10.2
v7.10.3
v7.10.4
v7.11.0
v7.12.0
v7.13.0
v7.14.0
v7.15.0
v7.15.1
v7.2.0
v7.2.1
v7.2.2
v7.3.0
v7.3.1
v7.4.0
v7.4.1
v7.4.2
v7.5.0
v7.5.1
v7.5.2
v7.6.0
v7.6.1
v7.6.2
v7.6.3
v7.7.0
v7.7.1
v7.8.0
v7.8.1
v7.9.0
v8.*
v8.0.0
v8.1.0
v8.2.0
v8.3.0
v8.3.1
v9.*
v9.0.0
v9.1.0
v9.1.1
v9.1.2
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.3.4
v9.3.5
v9.3.6
v9.4.0
v9.4.1
v9.5.0
v9.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54493.json"