PT-2026-135457
CVE-2026-120441
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
OwnTone Server through 29.3 contains an sql injection vulnerability in mpd sticker find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.
Found an issue in the description? Have something to add? Feel free to write us 👾