Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

published 2026-06-12 4 mo ago modified 2026-07-15 3 mo ago also GHSA-jr4p-4xjh-fwvw , EUVD-2026-36546

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits: 0; none known

Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule — which issues HTTP requests to the supplied URL — still executes even after the SafeUrl rule has rejected the URL as pointing to a private/reserved address. Any authenticated, non-admin user can therefore coerce the server into making HEAD/GET requests to arbitrary internal hosts. This issue has been patched in version 9.7.1.

Patch / fix

fixed in 1 links 3

packagist phanan/koel 9.7.1

github.com/koel/koel@5f6ce2c commit
github.com/koel/koel#2549 pull request
github.com/koel/koel/releases/tag/v9.7.1 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 4 mo ago (2026-06-15)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
GitHub	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
packagist	phanan/koel	<9.7.1	9.7.1

Affected products

koel koel

Classification

Weakness

CWE-918 Server-Side Request Forgery

References

github.com /koel/koel/commit/5f6ce2cefd08f437a269236b677ad971517ccbb6
web
github.com /koel/koel/pull/2549
web
github.com /koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw
exploit, web
nvd.nist.gov /vuln/detail/CVE-2026-50552
advisory
github.com /koel/koel
package
github.com /koel/koel/releases/tag/v9.7.1
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary