CVE-2026-50233: Exposure of Information Through Directory Listing in LMS Community Lyrion Music Server
Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js). The query accepts a folder parameter and lists its contents with no restriction to the configured media directories and no authentication in the default configuration, allowing a remote, unauthenticated attacker to enumerate arbitrary locations on the host filesystem.
AI Analysis
Technical Summary
CVE-2026-50233 describes an arbitrary directory listing vulnerability in Lyrion Music Server 9.2.0. The readdirectory query accepts a folder parameter that is not properly restricted to configured media directories and does not require authentication by default. This allows remote attackers to enumerate arbitrary directories on the host filesystem through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js).
Potential Impact
An unauthenticated remote attacker can enumerate arbitrary directories on the host filesystem, potentially exposing sensitive file and directory information. This information disclosure could aid further attacks but does not directly allow modification or execution of files.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restricting network access to the affected services and disabling or securing the readdirectory query may reduce exposure.
CVE-2026-50233: Exposure of Information Through Directory Listing in LMS Community Lyrion Music Server
Description
Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js). The query accepts a folder parameter and lists its contents with no restriction to the configured media directories and no authentication in the default configuration, allowing a remote, unauthenticated attacker to enumerate arbitrary locations on the host filesystem.
CVSS v4.0
Score 6.9medium
Affected software
pkg:github/lmscommunity/lyrion-music-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-50233 describes an arbitrary directory listing vulnerability in Lyrion Music Server 9.2.0. The readdirectory query accepts a folder parameter that is not properly restricted to configured media directories and does not require authentication by default. This allows remote attackers to enumerate arbitrary directories on the host filesystem through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js).
Potential Impact
An unauthenticated remote attacker can enumerate arbitrary directories on the host filesystem, potentially exposing sensitive file and directory information. This information disclosure could aid further attacks but does not directly allow modification or execution of files.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restricting network access to the affected services and disabling or securing the readdirectory query may reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-04T10:47:01.275Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a22d3b5e29bf47b5076ed70
Added to database: 06/05/2026, 13:48:37 UTC
Last enriched: 06/13/2026, 09:34:20 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.