CVE-2026-55598 in PinePods
Summary
by MITRE • 10/30/2026
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in `rust-api/src/database.rs` parse the feed with `feed-rs` and store the `<enclosure url>` verbatim in `Episodes.episodeurl` without destination host/IP validation. `POST /api/data/download_podcast` invokes `spawn_download_podcast_episode` and `download_episode_and_wait()` in `rust-api/src/services/tasks.rs`, which sends a `reqwest` GET to the stored URL and saves and records the response in `DownloadedEpisodes` for later retrieval. The `estimate_duration_from_audio_url_async()` path in `rust-api/src/database.rs` also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
PinePods is a comprehensive, self-hosted podcast management system developed in Rust that allows users to manage and download audio content via RSS feeds. A critical server-side request forgery vulnerability exists in versions prior to 0.9.0, stemming from insufficient validation of URLs provided by authenticated users during the process of adding or refreshing podcasts. The application accepts user-supplied enclosure URLs through the POST /api/data/add_podcast endpoint and stores them verbatim without performing any destination host or IP address validation. This lack of sanitization allows an attacker to specify arbitrary targets, including internal network addresses, loopback interfaces, and cloud metadata service endpoints that are typically inaccessible from external networks.
The technical flaw is rooted in the handling of RSS feed data by functions such as get_podcast_values and add_episodes within rust-api/src/database.rs. These components utilize the feed-rs library to parse incoming feeds but fail to restrict the scheme or destination of the enclosure URLs before storage. When a user triggers a podcast download via POST /api/data/download_podcast, the system invokes spawn_download_podcast_episode and download_episode_and_wait in rust-api/src/services/tasks.rs. This sequence initiates an HTTP GET request using reqwest directly from the server to the stored URL. Additionally, during feed addition or refresh operations, the estimate_duration_from_audio_url_async function performs an unvalidated HEAD request to determine audio duration. Both mechanisms rely on default redirect following behavior, which permits an initially external-looking URL to redirect to a sensitive internal target, thereby bypassing any superficial checks that might have been intended by relying solely on initial input validation rather than final destination verification.
The operational impact of this vulnerability is severe for environments where server-side downloads are enabled, which is the default configuration in PinePods. Since self-service signup is supported, even low-privilege users can exploit this flaw to conduct internal service enumeration and access confidential data residing on local services or cloud metadata endpoints. Attackers can read downloaded responses from these internal targets, potentially leading to the disclosure of sensitive information such as API keys, authentication tokens, or other credentials stored in response bodies. This capability effectively transforms a standard podcast management application into a powerful proxy for attacking internal infrastructure, facilitating lateral movement and data exfiltration within trusted network boundaries that are otherwise protected by perimeter defenses.
This vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically involving the lack of validation on user-supplied URLs leading to unauthorized access to internal resources. It also maps to MITRE ATT&CK technique T1560, which involves data staged via archive collections or similar mechanisms where an attacker stages collected data for exfiltration by leveraging server-side requests. The exploitation path demonstrates how application-level logic flaws can undermine network security controls by allowing the application itself to act as a bridge into restricted zones.
To mitigate this risk, organizations running PinePods must upgrade immediately to version 0.9.0 or later, where these validation checks have been implemented. In cases where upgrading is not immediately feasible, administrators should disable server-side downloads if they are not strictly necessary for their use case, thereby preventing the application from making outbound requests on behalf of users. Additionally, implementing strict allow-lists for permitted URL schemes and destination IP ranges at a network level or within an intermediate proxy can provide defense-in-depth against SSRF attempts. Regular security audits focusing on input validation and output encoding practices are recommended to prevent similar vulnerabilities in other components of the application stack.