Riskcovery

CVE-2026-41457

OwnTone Server < 29.1 SQL Injection via query and filter Parameters

State
Published
Severity
6.9 Medium
Published
Apr 22, 2026
Updated
Jul 14, 2026
Reserved
Apr 20, 2026

Read the record on cve.org

Description

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NVulnCheck

Weaknesses

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
owntone-serverowntone
  • 28.4.0 to before 29.1.0Affected
  • d4784ebf2099ed1a4203333aee957e5c7553c217Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.