Description
OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| owntone | owntone-server | 28.4.0 – < 29.1.0 | 29.1.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | owntone | 29.3-1.1 | openSUSE-SU-2026:12216-1 |
Advisories 1
- openSUSE-SU-2026:12216-1 owntone-29.3-1.1 on GA media SUSE / openSUSE Security Updates · Oct 22, 2026