CVE-2026-120441: OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

Published Nov 2, 2026

Updated

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Deployments running OwnTone Server through 29.3 are exposed if an attacker can reach the MPD listener on TCP port 6600. The vulnerable command can be used without authentication.

What access does an attacker need to exploit this issue?

An attacker only needs network access to the MPD listener and the ability to send a crafted "sticker find song" command containing a malicious URI argument. No credentials or user interaction are required.

What information can be obtained through exploitation?

The described impact is bypass of path restrictions and enumeration of media files, including their filesystem paths and metadata. The provided data does not establish modification or deletion of data.

What can be done while a fix is being deployed?

Restrict access to TCP port 6600 so untrusted remote systems cannot reach the MPD listener. This directly removes the network access required by the described attack.

CVE-2026-120441: OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What access does an attacker need to exploit this issue?

What information can be obtained through exploitation?

What can be done while a fix is being deployed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What access does an attacker need to exploit this issue?

What information can be obtained through exploitation?

What can be done while a fix is being deployed?