Live › vulnerability › CVE-2026-120441
OwnTone Server through 29.3 has a SQL injection in mpd_sticker_find() that the MPD listener on TCP port 6600 passes to the database. An unauthenticated remote attacker can send a crafted 'sticker find song' command to bypass path restrictions and list all media files with their filesystem paths and metadata.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Any OwnTone Server through 29.3 whose MPD listener on TCP port 6600 is reachable by an attacker, since the flaw needs no login. Hosts where that port is only reachable on a trusted local network, or that are not running OwnTone, can skip it. The sources do not say whether a default install exposes the listener.
No product ranges from the sources yet.
owntone --version or the package manager's version query.6600 open in the host firewall or on the network edge.29.3; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.
This page as .md · .json · in your agent: get_signal("CVE-2026-120441")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.