CVE-2026-50232
CVE-2026-50232
Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (9.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
Weakness classification (CWE)
References
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (third-party-advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
Frequently asked questions
- What is CVE-2026-50232?
- CVE-2026-50232 is a high-severity vulnerability, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-06-05.
- How severe is CVE-2026-50232?
- High severity. CVSS v3 base score is 7.2 out of 10.