The vulnerability allows attackers to embed arbitrary JavaScript in media file metadata such as GENRE, ARTIST, or ALBUM. When the server scans the library, the unsanitized metadata is saved and rendered in the web interface using an unsafe XHTML formatter, causing the malicious script to execute in the victim’s browser. This can lead to session hijacking, defacement, or theft of sensitive information in the context of the LMS web application.

epoupon Lightweight Music Server version 3.76.0 is affected; no other products or versions were noted in the advisory.

The CVSS score of 5.1 indicates a moderate risk level. EPSS is not available and the issue is not listed in CISA’s KEV catalog, suggesting limited availability of public exploits. The likely attack path requires an attacker to place a crafted media file into the library—either by uploading or by otherwise adding the file—to trigger the stored XSS when users view the library in the web interface. The exploitation does not require privilege escalation or authentication bypass, but it does depend on the attacker’s ability to influence the media library contents.