{"id":"CVE-2026-120441","kind":"vulnerability","aliases":["CVE-2026-120441"],"related":[],"title":"OwnTone Server: SQL injection over MPD port lets attackers read media paths","description":"OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.","summary":"OwnTone Server through 29.3 has a SQL injection in mpd_sticker_find() that the MPD listener on TCP port 6600 passes to the database. An unauthenticated remote attacker can send a crafted 'sticker find song' command to bypass path restrictions and list all media files with their filesystem paths and metadata.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["media-server","mpd","owntone","package","self-hosted"],"not_affected_if":["owntone-not-installed","port-6600-not-reachable"],"how_to_check":"- Check the installed OwnTone version against the fixed release, if the sources name one: `owntone --version` or the package manager's version query.\n- Check whether the MPD listener is reachable from outside: look for port `6600` open in the host firewall or on the network edge.","fix":"- Move to a release newer than `29.3`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:26:12+00:00","updated_at":"2026-11-02T15:26:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:26:12Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than `29.3`; the exact fixed version is unknown from the sources.","reach":"internet","title":"OwnTone Server: SQL injection over MPD port lets attackers read media paths","impact":"medium","summary":"OwnTone Server through 29.3 has a SQL injection in mpd_sticker_find() that the MPD listener on TCP port 6600 passes to the database. An unauthenticated remote attacker can send a crafted 'sticker find song' command to bypass path restrictions and list all media files with their filesystem paths and metadata.","audience":"businesses","category":"package","nicknames":[],"who_cares":["owntone","mpd","self-hosted","media-server"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker lists all media file paths and metadata remotely","analyst_note":"Confirm the fixed version and whether the MPD listener is enabled by default, using the linked patch and the vulncheck advisory.","how_to_check":"- Check the installed OwnTone version against the fixed release, if the sources name one: `owntone --version` or the package manager's version query.\n- Check whether the MPD listener is reachable from outside: look for port `6600` open in the host firewall or on the network edge.\n- unknown for any other configuration check; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["port-6600-not-reachable","owntone-not-installed"],"who_is_affected":"Any OwnTone Server through 29.3 whose MPD listener on TCP port 6600 is reachable by an attacker, since the flaw needs no login. Hosts where that port is only reachable on a trusted local network, or that are not running OwnTone, can skip it. The sources do not say whether a default install exposes the listener.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000748,"input_tokens":4205,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120441':15A,18A '-2026':14A,17A '29.3':31B,82C '6600':47B,122C 'allow':95C 'argument':105C 'attack':9A,55B,98C,106C 'bypass':65B,124C 'command':63B,114C 'contain':83C 'craft':59B,110C 'cve':13A,16A 'databas':51B 'enumer':128C 'file':72B,131C 'filesystem':75B,133C 'find':39B,61B,91C,112C 'host':27B 'inject':4A,35B,86C,100C 'let':8A 'list':69B 'listen':43B,118C 'media':11A,20B,71B,130C 'media-serv':19B 'metadata':78B,136C 'mpd':6A,22B,37B,42B,89C,117C 'ownton':1A,23B,28B,79C 'packag':24B 'pass':48B 'path':12A,66B,76B,125C,134C 'port':7A,46B,121C 'read':10A 'remot':54B,97C 'restrict':67B,126C 'self':26B 'self-host':25B 'send':57B,108C 'server':2A,21B,29B,80C 'song':62B,113C 'sql':3A,34B,85C,101C 'src/mpd.c':93C 'sticker':38B,60B,90C,111C 'tcp':45B,120C 'unauthent':53B,96C 'uri':104C 'via':102C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Any OwnTone Server through 29.3 whose MPD listener on TCP port 6600 is reachable by an attacker, since the flaw needs no login. Hosts where that port is only reachable on a trusted local network, or that are not running OwnTone, can skip it. The sources do not say whether a default install exposes the listener.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mediaserver","medium","mpd","owntone","package","selfhosted"],"first_public_at":"2026-11-02T15:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120441","severity":null,"published_at":"2026-11-02T15:17:26+00:00","modified_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null}],"documents":[{"id":52472,"url":"https://github.com/owntone/owntone-server/commit/3164f12d18cd91c4973cc28f62298929cadac7da","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52473,"url":"https://www.vulncheck.com/advisories/owntone-server-through-29.3-sql-injection-via-mpd-sticker-find-command","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}