CVE Feed

    Dashboard / CVE / CVE-2026-120441

    CVE-2026-120441

    OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

    Published:Nov 2, 2026
    Last Modified:Nov 2, 2026
    EPS:Nov 2, 2026
    EPSS Score:
    CVSS Score:5.3

    Affected Products

    Vendor
    Owntone
    Product
    Owntone-server
    Vendor
    Owntone
    Product
    Owntone Server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-41457 (CVSS 6.9) — OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handl…
    CVE-2025-44560 (CVSS 9.8) — owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.…
    CVE-2026-26829 (CVSS 7.5) — A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa a…
    CVE-2026-26828 (CVSS 7.5) — A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d…
    CVE-2025-57156 (CVSS 7.5) — NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server …
    CVE-2025-63647 (CVSS 7.5) — A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allow…
    CVE-2025-63648 (CVSS 7.5) — A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server …
    CVE-2025-57155 (CVSS 7.5) — NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High