PT-2026-34239 · Owntone · Owntone-Server

Published 2026-04-22 · Updated 2026-04-25 · CVE-2026-41457

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OwnTone Server versions 28.4 through 29.0

Description Insufficient sanitization in DAAP query and filter handling allows attackers to inject arbitrary SQL expressions. This occurs when malicious values are supplied through the 'query=' and 'filter=' parameters for integer-mapped DAAP fields, enabling attackers to bypass filters and gain unauthorized access to media library data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-41457

Affected Products

Owntone-Server

References · 4

• https://github.com/owntone/owntone-server/commit/d4784ebf2099ed1a4203333aee957e5c7553c217 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41457 · Security Note
• https://twitter.com/CVEnew/status/2048168392243527776 · Twitter Post
• https://vulncheck.com/advisories/owntone-server-sql-injection-via-query-and-filter-parameters · Note