{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"owntone/owntone-server","product":"OwnTone Server","source":"CNA: VulnCheck","vendor":"OwnTone","versions":[{"lessThanOrEqual":"29.3","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-120441","cwes":["CWE-89"],"description":"OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793629742755,"publishedAt":1793629742755,"references":[{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/owntone/owntone-server/commit/3164f12d18cd91c4973cc28f62298929cadac7da"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/owntone/owntone-server/blob/29.3/src/mpd.c#L3029"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/owntone-server-through-29.3-sql-injection-via-mpd-sticker-find-command"}],"remediation":[],"revision":"4c54b815bf2106d161241ff60972fc112c35eb88facf56737c921b224b9a08ab","sources":[{"modifiedAt":1793629742755,"name":"CNA: VulnCheck","retrievedAt":1793632126569,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120441"}],"ssvc":null,"status":"published","title":"OwnTone Server through 29.3 SQL Injection via MPD sticker find Command","updatedAt":1793632126569}