CVE-2026-54494

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54494
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54494.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54494
Aliases
Published
2026-08-19T20:46:01.824Z
Modified
2026-08-21T03:46:50.217659466Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Details

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filtervar() with FILTERFLAGNOPRIVRANGE and FILTERFLAGNORES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1

Database specific 
{
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54494.json"
}
References

Affected packages

Git / github.com/koel/koel

Affected ranges

Type
GIT
Repo
https://github.com/koel/koel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5f6ce2cefd08f437a269236b677ad971517ccbb6
Fixed
4292d9844faed1e0f78d62be388152fd981c7437
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.7.1"
        }
    ]
}

Affected versions

1.*
1.0.0-beta
Other
latest
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v3.*
v3.0.0
v3.0.1
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.4.0
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.5.5
v3.6.0
v3.6.1
v3.6.2
v3.7.0
v3.7.1
v3.7.2
v4.*
v4.0.0
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.4.0
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.1.10
v5.1.11
v5.1.12
v5.1.13
v5.1.14
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.1.7
v5.1.8
v5.1.9
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.1.0
v6.10.0
v6.11.0
v6.11.1
v6.11.2
v6.11.3
v6.11.4
v6.11.5
v6.12.0
v6.12.1
v6.2.0
v6.2.1
v6.2.2
v6.3.0
v6.4.0
v6.4.1
v6.4.2
v6.4.3
v6.5.0
v6.5.1
v6.5.2
v6.5.3
v6.6.0
v6.7.0
v6.7.1
v6.7.2
v6.7.3
v6.7.5
v6.8.0
v6.8.1
v6.8.2
v6.8.3
v6.8.4
v6.8.5
v6.9.0
v7.*
v7.0.0
v7.0.1
v7.0.10
v7.0.11
v7.0.12
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.6
v7.0.7
v7.0.8
v7.0.9
v7.1.0
v7.10.0
v7.10.1
v7.10.2
v7.10.3
v7.10.4
v7.11.0
v7.12.0
v7.13.0
v7.14.0
v7.15.0
v7.15.1
v7.2.0
v7.2.1
v7.2.2
v7.3.0
v7.3.1
v7.4.0
v7.4.1
v7.4.2
v7.5.0
v7.5.1
v7.5.2
v7.6.0
v7.6.1
v7.6.2
v7.6.3
v7.7.0
v7.7.1
v7.8.0
v7.8.1
v7.9.0
v8.*
v8.0.0
v8.1.0
v8.2.0
v8.3.0
v8.3.1
v9.*
v9.0.0
v9.1.0
v9.1.1
v9.1.2
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.3.4
v9.3.5
v9.3.6
v9.4.0
v9.4.1
v9.5.0
v9.6.0
v9.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54494.json"