CVE-2026-50234

Deferred Deferred - Pending Action

Lyrion Music Server Path Traversal Vulnerability

Publication date: 2026-06-05

Last updated on: 2026-06-08

Assigner: VulnCheck

Description

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-05

Last Modified

2026-06-08

Generated

2026-07-16

AI Q&A

2026-06-05

EPSS Evaluated

2026-07-14

NVD

CVE-2026-50234

EUVD

EUVD-2026-34833

Affected Vendors & Products

Vendor	Product	Version / Range
lyrion	music_server	to 9.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-50234 is a path traversal vulnerability found in Lyrion Music Server version 9.2.0. It allows unauthenticated attackers to read arbitrary files on the server by exploiting directory traversal in the web server context.

Attackers manipulate file path parameters to access files outside the intended directory structure, potentially exposing sensitive information.

Impact Analysis

This vulnerability can have a significant impact as it allows attackers to read sensitive files without authentication.

Exposure of confidential or sensitive data stored on the server.
Potential leakage of configuration files, credentials, or other critical information.
Increased risk of further attacks leveraging the disclosed information.

Compliance Impact

The vulnerability allows unauthenticated attackers to read arbitrary files, including potentially sensitive files, by exploiting directory traversal in the web server context.

This unauthorized access to sensitive files could lead to exposure of personal or protected data, which may result in non-compliance with data protection regulations such as GDPR or HIPAA.

Organizations using Lyrion Music Server 9.2.0 or earlier should consider this risk as it may violate requirements for protecting sensitive information and ensuring confidentiality under these standards.

Hi! I’m here to help you understand CVE-2026-50234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70