Lightweight Music Server (LMS) versions up to 3.76.0 contain a stored cross-site scripting vulnerability (CVE-2026-48559) caused by improper neutralization of input during web page generation. Specifically, malicious JavaScript can be embedded within media file metadata tags (e.g., GENRE, ARTIST, ALBUM). When such a crafted media file is imported and scanned into the LMS library, the malicious script is stored and subsequently executed in the web interface because the tag content is rendered using Wt::TextFormat::UnsafeXHTML without proper sanitization in the source file src/lms/ui/Utils.cpp. This allows an attacker to execute arbitrary JavaScript in the context of the LMS web interface. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). No patch or official remediation is currently documented.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the LMS web interface of affected versions, potentially leading to session hijacking, unauthorized actions, or other client-side impacts within the context of the LMS application. The vulnerability requires the attacker to introduce a specially crafted media file into the victim's library, which is then scanned and rendered unsafely. There are no reports of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when importing media files from untrusted sources to avoid introducing malicious metadata. Monitoring vendor channels for updates is recommended.