CVE-2026-41457
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling. Attackers can inject arbitrary SQL expressions via the query= and filter= parameters for integer-mapped DAAP fields.
Risk Assessment
The risk involves bypassing filters and gaining unauthorized access to media library data, potentially leading to exposure of sensitive information.
Recommendation
It is recommended to immediately upgrade OwnTone Server to a version later than 29.0, which includes a fix for the SQL injection vulnerability.
Other vulnerabilities in OwnTone Server
See all- CVE-2026-120441Medium
OwnTone Server through 29.3 contains an SQL injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. A crafted 'sticker find song' command to the MPD listener on TCP port 6600 bypasses path restrictions and enumerates all media files with filesystem paths and metadata.
- CVE-2026-41458High
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
Original NVD description (English source)
OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS