The flaw lies in a readdirectory query that accepts an arbitrary folder name and returns its contents without validation. In the default configuration, the service exposes this query both on TCP port 9090 and a JSON‑RPC endpoint, and it does not require authentication. Consequently, a remote actor can request listings of any filesystem path, revealing files that are not intended for public consumption. The vulnerability is an instance of information disclosure (CWE‑548).

Lyrion Music Server Community edition, version 9.2.0. No other affected releases are reported in the current CVE entry.

With a CVSS score of 6.9, the issue is medium severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw remotely by either connecting to the CLI service over TCP or sending a JSON‑RPC call; no local privileges or additional credentials are required. The potential impact is the exposure of sensitive files or configuration data from arbitrary locations on the host.