OwnTone Server versions 28.4 through 29.0 include a SQL injection flaw in the handling of DAAP query and filter parameters. The flaw allows attackers to supply crafted values for integer-mapped DAAP fields through the query= and filter= HTTP parameters, bypassing the intended input sanitization and injecting arbitrary SQL expressions. The resulting SQL injection permits unauthorized read access to the media library database, potentially exposing confidential media metadata and file paths.

The vulnerability affects OwnTone Server software from version 28.4 up to and including 29.0. Only these builds are susceptible; version 29.1 and later are unaffected.

The CVSS score of 6.9 indicates moderate severity. While no EPSS score is publicly available and the vulnerability is not listed in the CISA KEV catalog, the flaw is potentially exploitable remotely over the DAAP interface, assuming the service is reachable by unauthenticated users. Attackers would need to craft malicious query or filter parameters to trigger the injection, making the attack vector likely network‑based via the DAAP protocol. The impact is primarily unauthorized data access rather than system compromise.