CVE-2026-120441

    Dashboard / Vulnerabilities / CVE-2026-120441

    CVE-2026-120441

    Published: 2 Nov 2026Last Modified: 4 Nov 2026

    Summary: OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

    Details: OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120441.json, https://nvd.nist.gov/vuln/detail/CVE-2026-120441, https://www.vulncheck.com/advisories/owntone-server-through-29.3-sql-injection-via-mpd-sticker-find-command, https://github.com/owntone/owntone-server/commit/3164f12d18cd91c4973cc28f62298929cadac7da, https://github.com/owntone/owntone-server, https://github.com/owntone/owntone-server/blob/29.3/src/mpd.c#L3029

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -3164f12d18cd91c4973cc28f62298929cadac7da

    Affected versions

    29.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-120441 | CVE-DB