CVE-2026-41457 is a SQL injection vulnerability in OwnTone Server affecting versions 28.4.0 through 29.0. The issue arises from improper sanitization of the query= and filter= parameters used in DAAP query and filter handling, specifically for integer-mapped DAAP fields. Attackers can exploit this to inject arbitrary SQL commands, bypassing intended filters and gaining unauthorized access to media library data. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official fix or patch has been documented as of the published date.

Successful exploitation allows an unauthenticated attacker to inject arbitrary SQL code through DAAP query and filter parameters, potentially bypassing access controls and retrieving unauthorized media library information. This compromises the confidentiality of the media library data managed by OwnTone Server. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the DAAP service to trusted networks or users and monitor for unusual query parameter usage. Avoid exposing the vulnerable service to untrusted networks. Follow vendor updates closely for any forthcoming patches or official mitigations.