CVE-2026-120441 — Vulnerability intelligence
—
Published:
- CVSS
- 6.9
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.