madeofpendletonwool PinePods up to 0.8.x RSS Feed Parsing rust-api/src/database.rs get_podcast_values/add_episodes server-side request forgery

Summaryinfo

A vulnerability classified as problematic was found in madeofpendletonwool PinePods up to 0.8.x. Affected by this vulnerability is the function get_podcast_values/add_episodes of the file rust-api/src/database.rs of the component RSS Feed Parsing. Executing a manipulation can lead to server-side request forgery. This vulnerability is tracked as CVE-2026-55598. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in madeofpendletonwool PinePods up to 0.8.x. It has been declared as problematic. This vulnerability affects the function get_podcast_values/add_episodes of the file rust-api/src/database.rs of the component RSS Feed Parsing. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. CVE summarizes:

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in `rust-api/src/database.rs` parse the feed with `feed-rs` and store the `<enclosure url>` verbatim in `Episodes.episodeurl` without destination host/IP validation. `POST /api/data/download_podcast` invokes `spawn_download_podcast_episode` and `download_episode_and_wait()` in `rust-api/src/services/tasks.rs`, which sends a `reqwest` GET to the stored URL and saves and records the response in `DownloadedEpisodes` for later retrieval. The `estimate_duration_from_audio_url_async()` path in `rust-api/src/database.rs` also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-55598 since 06/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 0.9.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• madeofpendletonwool

Name

• PinePods

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8

Website

• Product: https://github.com/madeofpendletonwool/PinePods/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion