Description
OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.
INFO
Published Date :
2026-04-22T01:46:12.354Z
Last Modified :
2026-04-22T01:46:12.354Z
Source :
VulnCheck
AFFECTED PRODUCTS
The following products are affected by CVE-2026-41457 vulnerability.
| Vendors | Products |
|---|---|
| Owntone |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-41457.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability