SQL Injection Vulnerability in OwnTone Server by Owntone
CVE-2026-120441

6.9MEDIUM

Key Information:

Vendor

Owntone

Status
Owntone Server
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120441?

The OwnTone Server, up to version 29.3, has an SQL injection vulnerability located in the mpd_sticker_find() function within the src/mpd.c file. This vulnerability allows unauthenticated remote attackers to exploit this flaw by injecting SQL commands through the URI argument. By crafting a specific 'sticker find song' command, attackers can bypass path restrictions, potentially enabling them to access and enumerate all media files along with their filesystem paths and associated metadata.

Affected Version(s)

OwnTone Server 0 <= 29.3

References

https://github.com/owntone/owntone-server/commit/3164f12d...
patch
https://github.com/owntone/owntone-server/blob/29.3/src/m...
technical-description
https://www.vulncheck.com/advisories/owntone-server-throu...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani (Talence Security)
Espen Jurgensen
.