Koel's isPublicHost() function uses PHP's filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE to determine if an IP address is public. However, this method does not detect IPv6 transition addresses such as NAT64 (64:ff9b::/96) and 6to4 (2002::/16), which embed private IPv4 addresses. As a result, Koel incorrectly treats these addresses as public and allows outbound HTTP requests to them. Since podcast enclosure URLs are user-controllable and Koel fetches these URLs to stream episodes, an attacker can supply a URL resolving to a NAT64 or 6to4 address that maps to internal IPs or cloud metadata services. This causes Koel to perform SSRF with full response disclosure, bypassing the only SSRF defense in place. The vulnerability affects Koel versions before 9.7.1.

An attacker can exploit this vulnerability to perform server-side request forgery that reads data from internal network services or cloud instance metadata endpoints. This can lead to disclosure of sensitive internal information that is not normally accessible externally. The SSRF allows full reading of the response body from the targeted internal resource, potentially exposing confidential data or credentials.

A fix is available in Koel version 9.7.1 that addresses this issue. Users should upgrade to version 9.7.1 or later to mitigate this vulnerability. Until patched, users should be aware that the existing IP validation does not block IPv6 transition addresses embedding private IPv4 addresses, and should avoid subscribing to untrusted podcast feeds. Patch status is confirmed by the affectedVersions field indicating versions <9.7.1 are vulnerable.