CVE-2026-120441
Received Received - Intake

SQL Injection in OwnTone Server via MPD Sticker Command

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120441

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OwnTone OwnTone Server 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection flaw in OwnTone Server version 29.3 or earlier. It exists in the mpd_sticker_find() function in the src/mpd.c file. Attackers can send a specially crafted 'sticker find song' command with a malicious URI argument to the MPD listener on TCP port 6600. This allows unauthenticated remote attackers to inject SQL code, bypass path restrictions, and enumerate all media files including their filesystem paths and metadata.

Detection Guidance

To detect this vulnerability, check if OwnTone Server version 29.3 or earlier is running and listening on TCP port 6600. Use commands like 'netstat -tulnp | grep 6600' or 'ss -tulnp | grep 6600' to verify the service. Test the vulnerability by sending a crafted 'sticker find song' command with a URI argument containing SQL injection payloads to the MPD listener on port 6600.

Example test command: echo -e 'sticker find song "test"; DROP TABLE files;--"' | nc localhost 6600. If the server responds with database errors or unexpected data, it may be vulnerable.

Impact Analysis

An attacker could exploit this to access sensitive media file information on your system. They might learn the locations and metadata of all media files, potentially exposing private or confidential content. Since it requires no authentication, any system running vulnerable OwnTone Server software is at risk of unauthorized data enumeration.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating privacy requirements under GDPR and HIPAA. If media files contain personal data, the exposure could result in compliance breaches, potential fines, and reputational damage due to insufficient data protection measures.

Mitigation Strategies

Immediately upgrade OwnTone Server to a version that includes the fix for this vulnerability. The patch changes the SQL query construction in src/mpd.c to use %q instead of %s for the virtual_path variable, preventing SQL injection.

If upgrading is not immediately possible, restrict network access to TCP port 6600 using firewall rules to limit exposure to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...