CVE-2026-120441

CVSS 6.9 (medium) · published 2026-11-02

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

Weakness: CWE-89

Source: NVD CVE-2026-120441

References

• https://github.com/owntone/owntone-server/blob/29.3/src/mpd.c#L3029
• https://github.com/owntone/owntone-server/commit/3164f12d18cd91c4973cc28f62298929cadac7da
• https://www.vulncheck.com/advisories/owntone-server-through-29.3-sql-injection-via-mpd-sticker-find-command

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.