Vulnerability · Published Apr 22, 2026 · Assigned by VulnCheck

CVE-2026-41457OwnTone Server < 29.1 SQL Injection via query and filter Parameters

Medium 6.9

In plain English

A medium-severity SQL injection in owntone-server from owntone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 80.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.

Affected products (as reported)

Vendor	Product	Versions
owntone	owntone-server	28.4.0 – before 29.1.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References