{"id":10720,"date":"2026-09-04T18:51:24","date_gmt":"2026-09-04T10:51:24","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-54491"},"modified":"2026-09-04T18:51:24","modified_gmt":"2026-09-04T10:51:24","slug":"cve-2026-54491","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-54491","title":{"rendered":"CVE-2026-54491 [HIGH] &#8211; Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and"},"content":{"rendered":"<p>Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time AppHelpersNetwork::isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every redirect target. PhanAnPoddlePoddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), AppRulesHasAudioContentType, and AppRulesSafeUrl can therefore follow an attacker-controlled redirect to an internal address or connect after DNS rebinding changes a public resolution to a private one. These paths are reachable through podcast and radio APIs, including createPodcastChannel, createInternetRadioStation, refreshPodcasts, apiResource podcasts, and radio\/stations, allowing an authenticated user to request internal services or cloud metadata and potentially receive parsed or streamed response content. This issue is fixed in version 9.7.1.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time AppHelpersNetwork::isPublicHost() or isSafeUrl() check without pi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-10720","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/10720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10720"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}