The vulnerability is a stored cross-site scripting flaw that allows an attacker to inject malicious JavaScript into the Lyrion Music Server web interface by embedding payloads in media file metadata tags such as GENRE, ARTIST, and ALBUM. When a user views track information or plays a file, the script executes in the context of the web application, enabling the attacker to gain access to management functions and disclose configuration settings.

The problem affects the Lyrion Music Server Community edition, specifically version 9.2.0. No other versions are listed in the advisory.

The CVSS score of 5.1 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to upload or import a media file containing crafted metadata; once stored, any user who views or plays the track will have the injected code executed in their browser, enabling client-side attack vectors.