owntone owntone-server up to 29.0.x Expressions sql injection

Summaryinfo

A vulnerability marked as critical has been reported in owntone owntone-server up to 29.0.x. The impacted element is an unknown function of the component Expressions Handler. Performing a manipulation results in sql injection. This vulnerability is identified as CVE-2026-41457. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in owntone owntone-server up to 29.0.x. This affects an unknown code of the component Expressions Handler. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.

The weakness was released by younghyo cho as d4784ebf2099ed1a4203333aee957e5c7553c217. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-41457 since 04/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1505 for this issue.

Upgrading to version 29.1.0 eliminates this vulnerability. Applying the patch d4784ebf2099ed1a4203333aee957e5c7553c217 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-24585). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• owntone

Name

• owntone-server

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/owntone/owntone-server/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion