CVE-2026-120441 in Server
Summary
by MITRE • 11/02/2026
OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in OwnTone Server versions through 29.3 represents a critical security flaw rooted in improper neutralization of special elements used in an SQL command, commonly classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. This specific weakness manifests within the mpd_sticker_find function located in the src/mpd.c source file. The core technical issue arises from the application's failure to adequately sanitize or parameterize user-supplied input before incorporating it into a database query structure. Specifically, the URI argument passed by clients is directly concatenated or interpolated into SQL statements without sufficient validation against injection patterns. This lack of robust input handling allows malicious actors to manipulate the intended logic of the database operation, effectively turning a standard data retrieval function into an arbitrary code execution vector for structured queries.
From an operational perspective, this vulnerability enables unauthenticated remote attackers to exploit the Music Player Daemon (MPD) listener interface operating on TCP port 6600. By sending a crafted sticker find song command, adversaries can bypass inherent path restrictions designed to limit access to specific media directories. The exploitation of this flaw does not require prior authentication, significantly lowering the barrier for entry and increasing the risk profile substantially. Attackers can leverage SQL injection techniques such as UNION-based attacks or error-based extraction to extract sensitive information from the backend database. This capability allows for the enumeration of all media files stored on the server, including their complete filesystem paths and associated metadata. Such exposure compromises the confidentiality of the system's data structure and potentially reveals internal network topology if file paths contain sensitive directory names or host identifiers.
The impact extends beyond simple data leakage. The ability to enumerate all media files with full filesystem paths can facilitate further attacks by providing attackers with a detailed map of the server's content organization. This information is valuable for targeted phishing, social engineering, or identifying other vulnerable services running on the same infrastructure based on file naming conventions or directory structures. Furthermore, depending on the underlying database configuration and privileges granted to the application user account, more severe consequences such as data modification or deletion could theoretically be pursued if additional injection vectors are present in related functions. The vulnerability aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically through SQL commands used for reconnaissance and data exfiltration, highlighting its role in the initial access and discovery phases of an attack lifecycle.
Mitigation strategies must prioritize immediate patching to version 29.4 or later where this issue has been addressed by implementing proper input validation and parameterized queries within the mpd_sticker_find function. Until patches are applied, network-level controls should be enforced to restrict access to TCP port 6600 exclusively to trusted IP addresses using firewall rules or Access Control Lists. Additionally, deploying a Web Application Firewall with specific signatures for SQL injection patterns can provide an additional layer of defense by blocking malformed requests before they reach the application logic. It is also advisable to review database user permissions to ensure that the account used by OwnTone Server operates under the principle of least privilege, limiting its ability to perform destructive operations even if an injection succeeds. Regular security audits and static code analysis focused on SQL query construction practices are recommended to prevent similar vulnerabilities in future development cycles.