Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-41457

OwnTone Server < 29.1 SQL Injection via query and filter Parameters

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

owntone owntone-server

Default version status: unaffected

  • 28.4.0 to < 29.1.0affected
  • d4784ebf2099ed1a4203333aee957e5c7553c217unaffected
pkg:github/owntone/owntone-server

References