CVE-2026-120441
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 02, 2026
Vendor
unknown
Description
OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.