CVE-2026-48559 is a stored cross-site scripting vulnerability in epoupon's Lightweight Music Server (LMS) up to version 3.76.0. The vulnerability arises because the application uses Wt::TextFormat::UnsafeXHTML to render media file metadata tags (e.g., GENRE, ARTIST, ALBUM) without proper sanitization. An attacker can craft a media file with malicious HTML embedded in these tags, which, when imported into the victim's library, results in the payload being stored and executed in the LMS web interface. This can lead to arbitrary JavaScript execution in the context of the LMS web UI.

Successful exploitation allows an attacker with the ability to add media files to the LMS library to execute arbitrary JavaScript in the context of the LMS web interface. This can lead to session hijacking, unauthorized actions within the LMS UI, or other client-side attacks. The CVSS 4.0 base score is 5.1, indicating a medium severity vulnerability with network attack vector, low complexity, and requiring low privileges and user interaction.

No official patch or remediation has been confirmed as of the published date. Users should check the vendor advisory for updates. Until a fix is available, avoid importing untrusted media files into the LMS library. Consider restricting user permissions to prevent unauthorized media file additions. Monitor vendor communications for any forthcoming patches or official mitigations.