CVE-2026-54493

This CVE represents a security regression, not a novel vulnerability introduction. The Subsonic-compatible API endpoints in Koel bypassed the SafeUrl and HasAudioContentType checks that already existed in the main radio API — the same controls designed to prevent SSRF against internal services were simply absent from the compatibility path. The most likely cause isn't negligence but behavioral parity framing: developers building a compatibility layer are measured on whether the output matches the external spec, not whether it maintains security parity with the primary codebase. That's the cognitive hazard driving this class of vulnerability across countless API shims and compatibility layers in industry history. The practical severity hinges on deployment context. Koel runs commonly in Docker, and the fopen() call executes with the Docker bridge network available. An authenticated user can reach 172.17.0.1 (the default bridge gateway), probe adjacent containers, hit metadata services, or pivot through whatever else lives on that host's internal network. Authentication doesn't constrain the blast radius in containerized environments — it only determines which internal target gets queried. If Koel sits in a mesh with databases, redis, or management APIs, this becomes a pivot point into a network topology the application was never designed to protect. The EPSS score of 0.00264 likely reflects instrumentation gaps rather than genuine low exploitation risk. Generic SAST and DAST tools don't naturally model compatibility-layer attack surfaces — they see Subsonic endpoints as conceptually identical to main endpoints and never instrument the divergence. Mass scanners aren't looking here, which doesn't mean the risk is low; it means the risk is poorly observed. Prioritize patching to 9.7.0. Beyond that, treat this as a signal to audit any remaining compatibility layers or API shims for security parity with primary surfaces. The next security control added to the main API will face the same silent divergence unless your process explicitly measures and maintains compatibility-layer parity over time.

Reviewed through automated stages and approved by a human before publication.