Executive brief
OwnTone Server, a Linux-based media server for iTunes and Spotify streaming, is vulnerable to a security flaw in how it handles media library searches. An attacker can send specially crafted search or filter requests to bypass security restrictions and gain unauthorized access to the server's media database. This could allow an unauthorized user to view or extract information about the media library that they should not be able to see.
Technical details
A SQL injection vulnerability exists in OwnTone Server's DAAP (Digital Audio Access Protocol) parser, specifically within the handling of integer-mapped fields in the 'query=' and 'filter=' parameters. The root cause is insufficient sanitization of user-supplied input in 'src/parsers/daap_parser.y', where values were appended directly to SQL queries without validation. A remote, unauthenticated attacker can exploit this by supplying malicious SQL expressions in place of expected integer values to bypass filters or access unauthorized media library data. The issue is resolved in version 29.1 by implementing proper integer conversion using 'strtoll' before query construction.
Affected products
- OwnTone OwnTone Server 28.4 through 29.0
Timeline
- 2026-04-21: advisory: Initial advisory published by VulnCheck
- 2026-04-22: disclosed: CVE published to NVD
- 2026-04-21: patched: Fix committed to GitHub repository