koel

v9.7.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

audio laravel music music-player streaming vue

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 1mo

SSRF vulnerabilities in Subsonic podcast and internet radio endpoints have been closed; all outbound HTTP redirects are now fully validated.

Why it matters: Closing SSRF gaps prevents remote server abuse via affected endpoints, while validating every redirect hop blocks open‑redirect exploits. Severity scores: 90 for endpoint fixes, 70 for redirect validation.

Summary

AI summary

SSRF gaps closed in Subsonic endpoints and outbound redirects, plus new rating features.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Close SSRF gaps in Subsonic podcast and internet radio endpoints Close SSRF gaps in Subsonic podcast and internet radio endpoints Source: llm_adapter@2026-06-04 Confidence: high	—
Security	High	Validate every redirect hop on outbound HTTP requests Validate every redirect hop on outbound HTTP requests Source: llm_adapter@2026-06-04 Confidence: high	—
Feature
Feature	Medium	Add per‑song star ratings capability Add per‑song star ratings capability Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Add album and artist rating features Add album and artist rating features Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Introduce random album / artist carousels with reusable Carousel component Introduce random album / artist carousels with reusable Carousel component Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Add table view mode for radio stations Add table view mode for radio stations Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Low	Add EMBED_ENABLED toggle to disable embedding Add EMBED_ENABLED toggle to disable embedding Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix
Bugfix	Medium	Use heart icon consistently for favorite affordances across UI Use heart icon consistently for favorite affordances across UI Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Accept grid, list, and table values for view‑mode preferences Accept grid, list, and table values for view‑mode preferences Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Normalize legacy 'list' view mode for albums and artists Normalize legacy 'list' view mode for albums and artists Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Low	Make album/artist card body fill the grid cell Make album/artist card body fill the grid cell Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Low	Hide header action button on mobile when list isn't sortable Hide header action button on mobile when list isn't sortable Source: granite4.1:30b@2026-06-04-audit Confidence: low	—

Full changelog

What's Changed

feat: per-song star ratings by @phanan in https://github.com/koel/koel/pull/2536
fix: use heart icon consistently for favorite affordances by @phanan in https://github.com/koel/koel/pull/2538
feat: rate albums and artists by @phanan in https://github.com/koel/koel/pull/2539
fix: accept grid/list/table on view-mode preferences by @phanan in https://github.com/koel/koel/pull/2541
fix: normalize legacy 'list' view mode for albums and artists by @phanan in https://github.com/koel/koel/pull/2542
feat: random album / artist carousels + reusable Carousel by @phanan in https://github.com/koel/koel/pull/2540
fix: make album/artist card body fill the grid cell by @phanan in https://github.com/koel/koel/pull/2544
feat: table view mode for radio stations by @phanan in https://github.com/koel/koel/pull/2543
fix: close SSRF gaps in Subsonic podcast and internet radio endpoints by @phanan in https://github.com/koel/koel/pull/2545
fix: validate every redirect hop on outbound HTTP by @phanan in https://github.com/koel/koel/pull/2546
fix: hide header action button on mobile when list isn't sortable by @phanan in https://github.com/koel/koel/pull/2547
feat: add EMBED_ENABLED toggle to disable embedding by @phanan in https://github.com/koel/koel/pull/2548

Full Changelog: https://github.com/koel/koel/compare/v9.6.0...v9.7.0

Security Fixes

fix: close SSRF gaps in Subsonic podcast and internet radio endpoints
fix: validate every redirect hop on outbound HTTP

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track koel

Get notified when new releases ship.

About koel

Music streaming solution that works.

All releases →