CVE-2026-50233 is an arbitrary directory listing vulnerability in Lyrion Music Server 9.2.0. The readdirectory query accepts a folder parameter that is not properly restricted, allowing remote unauthenticated attackers to list contents of any directory on the host filesystem. The vulnerability is exposed through the CLI service on TCP port 9090 and the HTTP JSON-RPC endpoint /jsonrpc.js. There is no authentication required in the default configuration, increasing the risk of information disclosure. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

An attacker can remotely and without authentication enumerate arbitrary directories on the affected host, potentially exposing sensitive information about the filesystem structure and files. This information disclosure could aid further attacks but does not directly allow code execution or system compromise based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or patch is available, restrict network access to the affected services (TCP port 9090 and the HTTP JSON-RPC endpoint) to trusted users only. Consider disabling or restricting the readdirectory query if possible. Monitor vendor communications for updates on patches or official mitigations.