[ CVE-2026-120441 · Published 2 Nov 2026 ]
Vulnerability in OwnTone Server
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.