LMS Community Lyrion Music Server 9.2.0 CLI Service jsonrpc.js folder exposure of information through directory listing

Summaryinfo

A vulnerability was found in LMS Community Lyrion Music Server 9.2.0. It has been rated as problematic. This vulnerability affects unknown code of the file jsonrpc.js of the component CLI Service. The manipulation of the argument folder leads to exposure of information through directory listing. This vulnerability is documented as CVE-2026-50233. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in LMS Community Lyrion Music Server 9.2.0. This issue affects an unknown function of the file jsonrpc.js of the component CLI Service. The manipulation of the argument folder with an unknown input leads to a exposure of information through directory listing vulnerability. Using CWE to declare the problem leads to CWE-548. A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers. Impacted is confidentiality. The summary by CVE is:

Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js). The query accepts a folder parameter and lists its contents with no restriction to the configured media directories and no authentication in the default configuration, allowing a remote, unauthenticated attacker to enumerate arbitrary locations on the host filesystem.

The weakness was released by Gjoko Krstic as ZSL-2026-5991. The advisory is shared at zeroscience.mk. The identification of this vulnerability is CVE-2026-50233 since 06/04/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/05/2026). MITRE ATT&CK project uses the attack technique T1083 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34832). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• LMS Community

Name

• Lyrion Music Server

Version

• 9.2.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion