CVE-2026-50234
Lyrion Music Server Path Traversal Vulnerability
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lyrion | music_server | to 9.2.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-50234 is a path traversal vulnerability found in Lyrion Music Server version 9.2.0. It allows unauthenticated attackers to read arbitrary files on the server by exploiting directory traversal in the web server context.
Attackers manipulate file path parameters to access files outside the intended directory structure, potentially exposing sensitive information.
How can this vulnerability impact me? :
This vulnerability can have a significant impact as it allows attackers to read sensitive files without authentication.
- Exposure of confidential or sensitive data stored on the server.
- Potential leakage of configuration files, credentials, or other critical information.
- Increased risk of further attacks leveraging the disclosed information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to read arbitrary files, including potentially sensitive files, by exploiting directory traversal in the web server context.
This unauthorized access to sensitive files could lead to exposure of personal or protected data, which may result in non-compliance with data protection regulations such as GDPR or HIPAA.
Organizations using Lyrion Music Server 9.2.0 or earlier should consider this risk as it may violate requirements for protecting sensitive information and ensuring confidentiality under these standards.