CVE-2026-41457 in owntone-server
要約
〜によって MITRE • 2026年04月22日
OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.