CVE-2026-50234

Lyrion Music Server 9.2.0 Path Traversal File Read

View on CVE.org
Published Jun 5, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

Analysis

AI-generated

Technical impact

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows attackers without authentication to read arbitrary files from the server by manipulating file path parameters in the web interface. This could expose sensitive configuration files, credentials, and other confidential data, leading to a compromise of confidentiality and potentially enabling further exploitation.

Affected Systems

The affected product is LMS Community’s Lyrion Music Server version 9.2.0.

Risk and Exploitability

This vulnerability scores 8.7 on the CVSS scale, categorizing it as high severity. No EPSS value is available and the issue is not listed in the KEV catalog. The attack vector is most likely over the network via the web server, and no authentication or special privileges are required to exploit the directory traversal. Thus, any remotely exposed instance of the 9.2.0 release is at high risk of unauthorized file disclosure.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch or upgrade to a fixed version that addresses the path traversal flaw (CWE-22).
  • Restrict external access to the web interface via firewall rules or a VPN to prevent unauthenticated traversal attempts.
  • Configure the application to validate and sanitize file path inputs and enable logging to detect and block suspicious path traversal behavior.
  • Regularly check the vendor’s website or security advisories for updates on this vulnerability.

Generated by OpenCVE AI on June 5, 2026 at 15:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Lyrion
Lyrion lyrion Music Server
Vendors & Products Lyrion
Lyrion lyrion Music Server
Type Values Removed Values Added
Description Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.
Title Lyrion Music Server 9.2.0 Path Traversal File Read
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Jun 8, 2026, 6:17 PM
Reserved
Jun 4, 2026, 10:47 AM

View source JSON

Updated
Jun 8, 2026, 6:13 PM

JSON

Status
Deferred
Published
Jun 5, 2026, 2:16 PM
Modified
Oct 26, 2026, 11:10 AM

View source JSON

No data.

Updated
Jun 7, 2026, 11:16 AM

JSON