Medium severity5.3NVD Advisory· Published Nov 2, 2026· Updated Nov 2, 2026

CVE-2026-120441

Description

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Owntone/Owntone Serverllm-fuzzy
Range: <=29.3

Patches

Vulnerability mechanics

References

github.com/owntone/owntone-server/blob/29.3/src/mpd.cnvd
github.com/owntone/owntone-server/commit/3164f12d18cd91c4973cc28f62298929cadac7danvd
www.vulncheck.com/advisories/owntone-server-through-29.3-sql-injection-via-mpd-sticker-find-commandnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000