CVE-2026-55598

The PinePods podcast management system (prior to version 0.9.0 ) is vulnerable to Server-Side Request Forgery (SSRF) . An authenticated user can subscribe to a malicious RSS feed via POST /api/data/add_podcast, causing the system to parse and store values without host or IP validation. When down...

CVE-2026-55598 PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...

CVE-2026-55598: madeofpendletonwool PinePods: PinePods is a complete, self-hosted podcast management system written in Rust

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.r...