PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50233 LMS Community CVE debrief

CVE-2026-50233 is a MEDIUM severity vulnerability in Lyrion Music Server 9.2.0. The vulnerability is caused by an arbitrary directory listing in the readdirectory query, which is exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js). The query accepts a folder parameter and lists its contents with no restriction to the configured media directories and no authentication in the default configuration. This allows a remote, unauthenticated attacker to enumerate arbitrary locations on the host filesystem.

Vendor
LMS Community
Product
Lyrion Music Server
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-05
Advisory published
2026-06-05
Advisory updated
2026-06-05

Who should care

Users of Lyrion Music Server 9.2.0 should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability has a CVSS score of 6.9 and is classified as CWE-548. It was published on 2026-06-05T14:16:36.550Z and last modified on 2026-06-05T14:59:31.207Z.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply patches or updates to Lyrion Music Server 9.2.0 as soon as they are available.
  • Restrict access to the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js) to only trusted users.
  • Implement authentication and authorization for the readdirectory query.

Evidence notes

The vulnerability was reported by Vulncheck and Zero Science Lab.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50233 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50233

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50233 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50233

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.