Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's…
High CVSS 7.7
Summary
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f
- https://github.com/koel/koel/pull/2545
- https://github.com/koel/koel/releases/tag/v9.7.0
- https://github.com/koel/koel/security/advisories/GHSA-6p96-cfg5-4vhp
- https://github.com/koel/koel/security/advisories/GHSA-6p96-cfg5-4vhp
Timeline
- nvd_ingest NVD