TI-2026-83833 Aliases CVE-2026-120441 GHSA-fhcc-7j5h-5hf8

SQL injection in OwnTone Server via MPD sticker find command

LOW 37CWE-89Published 2026-11-02 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

OwnTone Server from 0 through 29.3 has an SQL injection flaw in mpd_sticker_find() that lets unauthenticated remote attackers inject SQL through the URI argument (CWE-89). Remote attackers can bypass path restrictions and enumerate all media files with their filesystem paths and metadata.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.005 43rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
owntone	OwnTone Server	up to 29.3	—	No fix listed	CNA

OwnTone Server Vendorowntone Affected up to 29.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for OwnTone Server.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

2026-11-02 Threatist record created from CVE-2026-120441
2026-11-02 CISA SSVC decision points changed
2026-11-02 Priority changed: MEDIUM → LOW
2026-11-02 Alias added: GHSA-fhcc-7j5h-5hf8

References

Patch 1

https://github.com/owntone/owntone-server/commit/3164f12d18cd91c4973cc28f62298929cadac7da

Other 1

https://github.com/owntone/owntone-server/blob/29.3/src/mpd.c#L3029

TI-2025-39393 A NULL pointer dereference in the dacp_reply_playqueueedit_move function… CVSS 3.1HIGH 7.5
TI-2025-39392 A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of… CVSS 3.1HIGH 7.5
TI-2025-35462 NULL pointer dereference in the dacp_reply_playqueueedit_clear function in… CVSS 3.1HIGH 7.5
TI-2021-15987 OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c. CVSS 3.1CRITICAL 9.8
TI-2025-35461 NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in… CVSS 3.1HIGH 7.5
TI-2026-30047 OwnTone Server < 29.1 Race Condition DoS via DAAP Login CVSS 4.0HIGH 8.2

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences