CVE-2026-50234 is a path traversal vulnerability in LMS Community's Lyrion Music Server 9.2.0. It allows unauthenticated remote attackers to bypass directory restrictions by manipulating file path parameters in HTTP requests, enabling them to read arbitrary files on the server. The vulnerability is exploitable over the network without authentication or user interaction, resulting in high impact confidentiality loss. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. No official remediation or patch has been published by the vendor as of the provided data.

Successful exploitation allows attackers to read sensitive files on the affected server, potentially exposing confidential information. Since no authentication is required, any remote attacker can exploit this vulnerability. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known public exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict external access to the Lyrion Music Server web interface and monitor for suspicious file access patterns. Avoid exposing the server to untrusted networks. Follow vendor channels for updates on patches or mitigations.