CVE-2026-50233 | BDVDB-2026-338308 Detail

Description#

Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js). The query accepts a folder parameter and lists its contents with no restriction to the configured media directories and no authentication in the default configuration, allowing a remote, unauthenticated attacker to enumerate arbitrary locations on the host filesystem.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-06-05Record published in the CVE List.
2. Version 22026-06-09Most recent update recorded in the CVE List.