Lyrion Music Server CVE-2026-50233

Q: What is the CVSS score of CVE-2026-50233?

CVE-2026-50233 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34832 MEDIUM

Exposure of Information Through Directory Listing (CWE-548)

2026-06-05 VulnCheck

GHSA-36hm-c9f8-f8xc

Information Disclosure Lyrion Music Server Lms Community

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 05, 2026 - 14:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

Jun 05, 2026 - 14:18 vuln.today

DescriptionCVE.org

Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js). The query accepts a folder parameter and lists its contents with no restriction to the configured media directories and no authentication in the default configuration, allowing a remote, unauthenticated attacker to enumerate arbitrary locations on the host filesystem.

AnalysisAI

Arbitrary filesystem directory listing in Lyrion Music Server 9.2.0 exposes any host directory to remote unauthenticated attackers via the readdirectory query, which accepts an unsandboxed folder parameter with no path restriction. Both the CLI service on TCP port 9090 and the HTTP JSON-RPC endpoint at /jsonrpc.js are affected, presenting a dual-protocol attack surface that requires no credentials in the default configuration. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trivial attack complexity - a single unauthenticated network request - significantly lowers the real-world barrier to abuse.

Technical ContextAI

Lyrion Music Server (formerly Logitech Media Server / Squeezebox Server) is an open-source streaming audio server maintained by the LMS Community, identified by CPE cpe:2.3:a:lms_community:lyrion_music_server:*:*:*:*:*:*:*:*. The server exposes a text-based CLI over TCP port 9090 and an HTTP JSON-RPC API at /jsonrpc.js. The readdirectory query is designed for browsing configured media directories but accepts a folder parameter with no allowlist enforcement, chroot boundary, or path normalization. CWE-548 (Exposure of Information Through Directory Listing) identifies the root cause class: directory structure is exposed without restricting access to designated application paths or requiring authentication, enabling traversal of arbitrary host filesystem locations such as /etc, /home, or application configuration directories.

RemediationAI

No vendor-released patch or confirmed fixed version has been identified in the available intelligence at time of analysis; organizations should monitor the LMS Community project and the ZeroScience advisory at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5991.php and VulnCheck advisory at https://www.vulncheck.com/advisories/lyrion-music-server-arbitrary-directory-listing for patch availability. As an immediate compensating control, restrict network access to TCP port 9090 and the HTTP service hosting /jsonrpc.js to trusted internal IP ranges using host-based firewall rules or perimeter ACLs - this eliminates remote exploitation but does not protect against an internal attacker with network access to those ports. If the CLI service on port 9090 is not operationally required, disable it entirely to reduce attack surface; note this may affect integrations or remote control clients. If the application version supports optional authentication on the web interface, enable it, noting the default configuration ships without it. Under no circumstances should Lyrion Music Server be directly internet-exposed until an official patch is released.