The vulnerability in OwnTone Server 29.3 allows an unauthenticated attacker to inject arbitrary SQL into the MPD sticker find command via the URI argument. By sending a crafted "sticker find song" request to the MPD listener on TCP port 6600, the attacker bypasses normal path restrictions and can enumerate all media files, revealing filesystem paths and metadata.

Affected products are OwnTone Server versions up to and including 29.3. The vulnerability is present in all builds that include the mpd.c implementation shown in the source code reference.

The CVSS score of 6.9 indicates moderate severity, and the lack of an EPSS score or KEV listing suggests limited public exploitation data. Nonetheless, the flaw is unauthenticated and remote, requiring only that an attacker reach port 6600 to trigger a data‑exfiltration attack. No special privileges are needed to abuse it.