OwnTone Server CVE-2026-120441

Requires network reachability to OwnTone's MPD protocol listener on TCP port 6600 (the MPD emulation feature must be active). The attacker sends a 'sticker find song' command whose URI/virtual_path argument is interpolated unescaped into a SQLite LIKE filter - the vendor fix confirms this by switching the %s specifier to %q for virtual_path in db_mprintf. No authentication is required (PR:N) and no user interaction (UI:N). The practical limiting factor is exposure: OwnTone is typically deployed on a home/LAN and the MPD port is commonly bound to trusted networks rather than the public internet, so unauthenticated internet-wide exploitation depends on the listener being reachable (e.g. via port forwarding or misconfiguration). Impact is also inherently limited to reading media paths and metadata, not modifying data.

The signals point to a moderate, info-disclosure-grade issue rather than a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is attacker-favorable - remote, unauthenticated, low complexity, no user interaction - but the impact is deliberately narrow: VC:L with VI:N/VA:N, i.e. read-only disclosure of media file paths and metadata, no write or denial-of-service capability. That is why the base score lands at 6.9 (Medium) despite the clean exploitability metrics. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with that bounded impact. No CISA KEV listing is present (not actively exploited per available data) and no EPSS score was supplied, so a precise exploitation-probability estimate is not possible from this input - state that gap explicitly rather than assume low probability. No working public exploit is referenced; the only code artifact is the vendor's own fix commit, which does confirm the mechanism. The dominant real-world limiter is reachability: this is a home/self-hosted media server and the MPD listener on TCP 6600 is typically LAN-bound, so internet-wide unauthenticated exploitation is unlikely absent misconfiguration or deliberate port exposure. Net: a genuine, vendor-confirmed SQLi worth patching in a normal monthly cycle, but not a drop-everything event given low impact, no KEV, no confirmed exploit, and constrained network exposure.

An attacker with network reachability to the OwnTone host connects to the MPD protocol listener on TCP 6600 and issues a crafted 'sticker find song' command whose URI argument carries SQL metacharacters, which are concatenated unescaped into a SQLite LIKE filter. This bypasses the intended path restriction and lets the attacker enumerate every media file's filesystem path and metadata. No working public exploit is referenced, though the vendor patch publicly discloses the exact vulnerable query.