Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120441OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

Medium 5.3

In plain English

A medium-severity SQL injection in OwnTone Server from OwnTone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

Affected products (as reported)

Vendor	Product	Versions
OwnTone	OwnTone Server	0 – through 29.3

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/owntone/owntone-server/commit/3164f12d18cd91c4973cc28f62298929cadac7da patch
https://github.com/owntone/owntone-server/blob/29.3/src/mpd.c#L3029 technical-description
VulnCheck Advisory: OwnTone Server through 29.3 SQL Injection via MPD sticker find Command third-party-advisory