PinePods CVE-2026-55598

Requires (1) an authenticated low-privilege PinePods account - self-service signup is supported, so an attacker can often create one; and (2) for the download sink, server-side downloads enabled, which is the default. The attacker subscribes to an attacker-controlled RSS feed via POST /api/data/add_podcast; the <enclosure url> (audio/* or video/* media type) is stored verbatim in Episodes.episodeurl with no host/IP validation, then fetched by reqwest on POST /api/data/download_podcast (GET, saved to disk/DownloadedEpisodes) and also via an unvalidated HEAD in estimate_duration_from_audio_url_async() during feed add/refresh. Because reqwest follows redirects by default, an initially external enclosure URL can 302-redirect to an internal target. Limiting factors: exploitation needs a valid session (not fully unauthenticated) and, for the read-back download sink, the default-on server-downloads setting; versions at or above 0.9.0 are not affected.

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, base 9.1) describes a network-reachable, low-complexity, low-privilege attack with a scope change, and every element is corroborated by the GHSA advisory's source-level analysis and working end-to-end proof-of-concept. The vuln.today decision label is act_now. The one notable discrepancy is severity magnitude: the vendor advisory self-rates this ≈7.6 (and labels it 'Medium') because exploitation is gated on an authenticated session and on server-downloads being enabled, whereas NVD/the provided score is 9.1 - the difference is driven by PR and the read-back amplification, not by any dispute over the mechanism. Both agree on the core signals. No EPSS score was provided (cannot assess statistical exploitation probability) and the input contains no CISA KEV entry, so there is no evidence of in-the-wild exploitation; however, a complete, reproducible PoC with captured output is published in the GHSA advisory, so the barrier to exploitation is low. The authentication gate is materially weakened because self-service signup is supported, meaning an attacker can often provision their own low-privilege account. Net: treat as act_now for exposed/internet-reachable instances, especially in cloud environments with reachable instance-metadata services.

A low-privilege user (potentially self-registered via supported self-service signup) subscribes to an attacker-controlled RSS feed whose <enclosure url> points at an internal target such as http://169.254.169.254/latest/meta-data/ or a loopback admin service, then triggers POST /api/data/download_podcast. The PinePods server issues the fetch, follows any redirects into the internal network, and saves the internal response to disk as the 'episode' file, which the attacker then downloads to read back the stolen data. A complete end-to-end proof-of-concept (including captured cloud-metadata-style and loopback read-back output against the default Docker image) is published in the vendor GHSA advisory.