CVE-2026-41457

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions through the query= and filter= parameters. The vulnerability stems from insufficient sanitization of parameters used for integer-mapped DAAP fields, enabling attackers to bypass filters and gain unauthorized access to media library data. The attack requires network access to the vulnerable DAAP service and appears to have low complexity, as it exploits straightforward parameter injection. The primary impact is confidentiality compromise, allowing unauthorized disclosure of media library information. The FAUCET Risk Score of 46.0/100 indicates moderate risk, though the EPSS score of 0.00036 suggests relatively low exploitation probability across the threat landscape. There is currently no indication of active exploitation in the wild. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog, and it remains inactive on threat tracking hot lists. No publicly available exploit code has been confirmed, and community attention appears minimal at this time. Organizations running affected OwnTone Server versions should prioritize patching to versions 29.1 or later to mitigate this vulnerability.