Which versions of Lyrion Music Server are affected by CVE-2026-50234?

Lyrion Music Server 9.2.0 contains a high-severity vulnerability (CVSS 8.7) allowing unauthenticated remote attackers to read arbitrary files from affected systems without credentials or user…

How to fix or mitigate CVE-2026-50234?

Within 24 hours: Inventory all Lyrion Music Server 9.2.0 instances and assess network exposure to untrusted users. Within 7 days: Implement network segmentation to restrict server access to trusted internal networks only; deploy WAF rules blocking directory traversal patterns (../ and ..\ sequences); enable comprehensive access logging on affected systems. Within 30 days: Contact vendor regarding patch timeline and security roadmap; evaluate upgrade path to patched release; consider product replacement if patch timeline exceeds acceptable risk window.

Lyrion Music Server CVE-2026-50234

Q: What is the CVSS score of CVE-2026-50234?

CVE-2026-50234 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-34833 HIGH

Path Traversal (CWE-22)

2026-06-05 VulnCheck

GHSA-c46g-chv5-xw5r

Path Traversal Lyrion Music Server Lms Community

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 05, 2026 - 14:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 05, 2026 - 14:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 05, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jun 05, 2026 - 14:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 05, 2026 - 14:15 vuln.today

DescriptionCVE.org

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

AnalysisAI

Unauthenticated arbitrary file read in Lyrion Music Server 9.2.0 allows remote attackers to retrieve sensitive files from the host by manipulating directory traversal sequences in file path parameters handled by the embedded web server. The flaw is network-reachable with no authentication or user interaction required, and publicly available exploit code exists via the Zero Science Lab advisory ZSL-2026-5992. No CISA KEV listing or EPSS score was provided, so widespread opportunistic exploitation has not been confirmed, but the low barrier to abuse makes opportunistic scanning likely.

Technical ContextAI

Lyrion Music Server (formerly Logitech Media Server, maintained by the LMS Community) is an open-source streaming audio server that exposes an HTTP-based web interface and API for media browsing and control. The vulnerability is a classic CWE-22 'Improper Limitation of a Pathname to a Restricted Directory' issue in which the web server fails to canonicalize or restrict path parameters before reading files from disk, allowing '../' style sequences to escape the intended document root. The affected CPE 'cpe:2.3:a:lms_community:lyrion_music_server' confirms the LMS Community fork is in scope, and the bug lives in the HTTP request handling layer rather than in a media decoding component, making it directly reachable on whatever interface and port the server listens on (default TCP/9000).

RemediationAI

No vendor-released patch identified at time of analysis - neither reference points to a fixed version, so operators should monitor the LMS Community project for an updated release beyond 9.2.0 and consult the VulnCheck advisory at https://www.vulncheck.com/advisories/lyrion-music-server-path-traversal-file-read and Zero Science Lab advisory at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5992.php for fix tracking. Until a patch ships, restrict the web server (default TCP/9000) to trusted LAN segments via host firewall or perimeter ACL and remove any port-forwarding or reverse-proxy exposure to the internet, accepting the trade-off that remote control via the web UI will no longer be reachable from outside the network. Placing the service behind an authenticating reverse proxy (e.g., a basic-auth-protected nginx) blunts unauthenticated abuse and is the lowest-friction compensating control, though it does not fix the underlying traversal and a compromised authenticated user could still trigger the read.