CVE-2026-50232 describes a stored cross-site scripting vulnerability in Lyrion Music Server 9.2.0. Attackers can embed malicious JavaScript payloads within media file metadata tags (e.g., GENRE, ARTIST, ALBUM). These payloads execute in the context of the web interface when users access track details or play the affected media files. This can lead to unauthorized access to management functions and disclosure of configuration settings. The vulnerability is network exploitable with low attack complexity and requires low privileges with user interaction. No vendor advisory or patch information is available at this time.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the web interface, potentially leading to unauthorized access to management functions and disclosure of sensitive settings. This compromises the confidentiality and integrity of the affected system's management interface. The vulnerability is rated medium severity with a CVSS score of 5.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid opening or playing media files from untrusted sources that may contain malicious metadata. Monitor vendor communications for updates on patches or mitigations.