Executive Summary

CVE-2026-50230 is a reflected cross-site scripting (XSS) vulnerability in Lyrion Music Server version 9.2.0 or earlier.

The vulnerability exists in the server.log endpoint, where attackers can inject arbitrary HTML and JavaScript code through the search parameter without authentication.

Attackers can craft malicious URLs containing JavaScript payloads in the search parameter to execute code in users' browsers within the context of the affected application.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript code in the browsers of users who visit maliciously crafted URLs.

Such code execution can lead to theft of user data, session hijacking, or other malicious actions performed within the context of the vulnerable application.

Since the attack requires user interaction (clicking a malicious link), it can be used in phishing or social engineering attacks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to the server.log endpoint for suspicious or malicious payloads in the search parameter. Specifically, look for URLs containing JavaScript code or unusual HTML tags within the search parameter.

You can use network traffic inspection tools or web server logs to identify such requests.

• Use curl or wget to test the endpoint with a crafted URL containing a harmless JavaScript payload, for example: curl "http://<target-server>/server.log?search=<script>alert(1)</script>"
• Use grep on web server logs to find requests to server.log with suspicious search parameters: grep "server.log" /var/log/apache2/access.log | grep "search="
• Use intrusion detection systems (IDS) or web application firewalls (WAF) to detect reflected XSS patterns in HTTP requests targeting the server.log endpoint.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying input validation and output encoding on the search parameter in the server.log endpoint to prevent injection of arbitrary HTML and JavaScript.

If a patch or update is available from the vendor, upgrade to a fixed version of Lyrion Music Server.

As a temporary measure, consider implementing a web application firewall (WAF) rule to block or sanitize requests containing suspicious scripts in the search parameter.

Educate users to avoid clicking on suspicious URLs that may contain malicious payloads targeting this vulnerability.

Useful 0 Not Useful 0