CVE-2026-50232

Lyrion Music Server 9.2.0 Stored XSS via Metadata Tags

View on CVE.org
Published Jun 5, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure.

Analysis

AI-generated

Technical impact

The vulnerability is a stored cross-site scripting flaw that allows an attacker to inject malicious JavaScript into the Lyrion Music Server web interface by embedding payloads in media file metadata tags such as GENRE, ARTIST, and ALBUM. When a user views track information or plays a file, the script executes in the context of the web application, enabling the attacker to gain access to management functions and disclose configuration settings.

Affected Systems

The problem affects the Lyrion Music Server Community edition, specifically version 9.2.0. No other versions are listed in the advisory.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to upload or import a media file containing crafted metadata; once stored, any user who views or plays the track will have the injected code executed in their browser, enabling client-side attack vectors.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Lyrion Music Server release that resolves the stored XSS issue.
  • Implement input validation and output encoding for metadata fields, ensuring script tags or event handlers are stripped or encoded before display.
  • Restrict or sanitize media uploads by disabling edit of metadata tags in the web interface or performing server-side checks to reject files containing script payloads.

Generated by OpenCVE AI on June 5, 2026 at 15:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Lyrion
Lyrion lyrion Music Server
Vendors & Products Lyrion
Lyrion lyrion Music Server
Type Values Removed Values Added
Description Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure.
Title Lyrion Music Server 9.2.0 Stored XSS via Metadata Tags
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Jun 8, 2026, 5:06 PM
Reserved
Jun 4, 2026, 10:47 AM

View source JSON

Updated
Jun 8, 2026, 5:05 PM

JSON

Status
Deferred
Published
Jun 5, 2026, 2:16 PM
Modified
Oct 26, 2026, 11:10 AM

View source JSON

No data.

Updated
Jun 7, 2026, 11:16 AM

JSON