PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through "POST /api/data/add_podcast" in "rust-api/src/handlers/podcasts.rs". "get_podcast_values" and "add_episodes" in "rust-api/src/database.rs" parse the feed with "feed-rs" and store the "<enclosure url>" verbatim in "Episodes.episodeurl" without destination host/IP validation. "POST /api/data/download_podcast" invokes "spawn_download_podcast_episode" and "download_episode_and_wait()" in "rust-api/src/services/tasks.rs", which sends a "reqwest" GET to the stored URL and saves and records the response in "DownloadedEpisodes" for later retrieval. The "estimate_duration_from_audio_url_async()" path in "rust-api/src/database.rs" also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.